Contents
This Privacy Policy explains how Soft Cat Media Limited ("we", "us", "our") collects, uses, discloses, retains and protects personal data in connection with www.xiaofamao.com, its sub-domains (including user.xiaofamao.com), and all related tools, applications, application programming interfaces and services (together, the "Services").
We are a company incorporated in Hong Kong and we handle personal data in accordance with the Personal Data (Privacy) Ordinance (Cap. 486) of the Hong Kong Special Administrative Region (the "PDPO") and the guidance issued by the Privacy Commissioner for Personal Data ("PCPD").
This Policy does not apply to third-party websites, applications or services that we do not control, even if they are accessible from the Services.
We are the "data user" (as defined in the PDPO) in respect of the personal data described in this Policy. The person to whom you may direct any question, request or complaint about personal data is:
Soft Cat Media Limited — Data Protection Contact
Hong Kong
Email: freeeim@gmail.com
Communications are accepted by email in Chinese or English. If you require a postal correspondence address, please request it using the email address above and we will provide it.
We design our handling of personal data around the six Data Protection Principles ("DPPs") set out in Schedule 1 to the PDPO:
| Principle | Our commitment |
|---|---|
| DPP1 — Data Collection | We collect personal data in a lawful and fair manner, only for purposes directly related to our functions and activities, and only what is necessary and not excessive. We tell you the purpose of collection and the classes of persons to whom the data may be transferred, as set out in the Personal Information Collection Statement in section 9. |
| DPP2 — Accuracy and Retention | We take practicable steps to keep personal data accurate, and we do not keep personal data longer than is necessary for the purpose for which it is used. Where we engage a data processor, we impose the same retention requirements by contract or other means. |
| DPP3 — Data Use | We use personal data only for the purpose for which it was collected, or a directly related purpose, unless you give voluntary and express consent to a new purpose. You may withdraw consent at any time by written notice to us. |
| DPP4 — Data Security | We take practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss or use, and we require our data processors to do the same by contract or other means. |
| DPP5 — Openness | We publish this Policy so that you know our personal data practices, the kinds of personal data we hold and the purposes for which we hold it. |
| DPP6 — Access and Correction | You have the right to request access to and correction of your personal data. If we refuse a request, we will give you our reasons. |
The categories of personal data we may collect, and how we obtain them, are summarised below. We do not collect more than we need for the purposes described in section 8.
| Category | Examples | How we obtain it |
|---|---|---|
| Account data | Account name, email address and/or mobile number, password (stored in hashed form), invitation or referral code, registration date, account status | From you, when you register at user.xiaofamao.com or sign in through a supported third-party login |
| Usage and quota data | Number of characters or requests processed, remaining quota, feature usage counts, error and diagnostic records | Generated automatically when you use the Services |
| Transaction data | Order reference, plan purchased, amount, currency, payment status and billing country | Generated when you purchase paid Services; payment card or wallet details are handled by the third-party payment provider and are not stored by us |
| Technical data | IP address, browser and operating system type, device type, language, referring page, requested URL, timestamps | Recorded automatically in our server logs when you use the Services |
| Cookie data | Session identifiers and preference settings | Placed on your device through your browser (see section 6) |
| Correspondence | Your name, contact details and the content of your message, including complaints and copyright notices | From you, when you contact us |
We do not knowingly collect "sensitive data" (such as identity card numbers, biometric data, health or criminal records) and we ask you not to submit such data to the Services.
Short version: we do not keep the text you paste into our rewriting tools.
Text you submit for processing (for example, the sentences you paste into the synonym-sentence rewriting tool, the text you send to our API, or an image you upload to a tool) is transmitted to our servers and processed for the sole purpose of producing the result that is returned to you. We do not keep a copy of your submitted text on our servers after your request has been completed, we do not use it for any other purpose, and we do not use it to train machine-learning models.
Because our tools accept free-form text, you are responsible for what you submit. Please do not submit:
Free-text input is not a place for secrets. Although we do not retain submitted text, no transmission over the internet can be guaranteed to be completely secure.
Cookies are small text files placed on your device. The Services use cookies and similar technologies for the following purposes:
| Type | Purpose and consequence of disabling |
|---|---|
| Strictly necessary | Keeping you signed in, maintaining your session, balancing load, and protecting the Services against automated abuse, excessive requests and fraud. If you block these cookies, you will not be able to sign in or use parts of the Services. |
| Preference | Remembering your settings, such as your chosen language or last-used options. Blocking them means your preferences will not be remembered. |
| Analytics and statistics | Third-party analytics code (for example, Baidu Analytics, which sets cookies and collects aggregated usage statistics such as page views, visit duration, browser type and region). This information is used to understand how the Services are used and to improve them. Some pages load such code only where it is needed. |
We may also use local storage and session storage in your browser for similar technical purposes.
How to manage cookies. Most browsers let you view, delete and block cookies through their settings. Because the strictly necessary cookies are required for signing in and for security, disabling them will affect your ability to use the Services. Any analytics cookies used by third parties are governed by those third parties' own privacy policies.
Like most websites, our servers automatically record limited technical information when you make a request, which may include your IP address, the date and time, the URL or API endpoint requested, the response code, the amount of data transferred, your user agent string and the referring page. We use this information only for service operation, security, detection and prevention of abuse, rate limiting, troubleshooting and aggregate statistics. Log entries are kept for a limited period and then deleted or overwritten, unless a longer period is necessary for the investigation of a security incident or as required by law.
We use personal data for the following purposes:
The following statement is given under Data Protection Principle 1(3) of the PDPO at the time we collect personal data from you:
| Purpose of collection | The purposes listed in section 8 of this Policy. |
|---|---|
| Whether provision is obligatory | Provision of account data is voluntary but necessary if you wish to register an account, save your usage or purchase paid Services. If you do not provide it, we may not be able to provide those parts of the Services. For the free tools that do not require an account, you may use them without registering, although technical data and server logs will still be recorded as described in sections 4, 6 and 7. |
| Consequences of not providing | We will not be able to create your account, provide account-based features, process payment and quota, or respond to your request. |
| Classes of transferees | The classes of persons described in section 11. |
| Your rights | You have the right to request access to and correction of your personal data, and to request a copy of your data, as explained in section 16. |
We comply with Part VIA of the PDPO. In particular:
We do not sell personal data. We may disclose personal data to the following classes of persons, on a need-to-know basis and, where they act as data processors, subject to contractual duties of confidentiality and security:
Where a copyright or other complaint is made about material associated with your account, we may need to share information with the complainant as described in our Copyright Complaints page and as required by the Copyright Ordinance (Cap. 528).
We are based in Hong Kong, but we use service providers and infrastructure that may store or process data in Hong Kong or in other jurisdictions. Personal data may therefore be transferred to, stored in, or accessed from places outside Hong Kong.
We keep personal data only for as long as is necessary for the purpose for which it was used:
| Data | Retention period |
|---|---|
| Text you submit to the tools | Not retained after your request is completed. |
| Account data | While your account is open, and for a reasonable period afterwards to deal with disputes, accounting, tax and legal obligations. Where an account is deleted, we delete or anonymise the account data as soon as practicable, subject to any legal retention requirement. |
| Transaction and accounting records | For the period required by applicable accounting, tax and commercial record-keeping requirements. |
| Server logs | A limited period, as described in section 7. |
| Correspondence and complaints | For as long as is reasonably necessary to handle the matter and to keep a record of our resolution, including the record-keeping required in connection with copyright notices. |
At the end of the applicable period, personal data is destroyed, erased or anonymised.
We take the security of personal data seriously and adopt measures that are appropriate to the sensitivity of the data, including:
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please keep your account credentials confidential and contact us immediately if you believe your account has been compromised.
We maintain an incident response process based on the PCPD's Guidance on Data Breach Handling and Data Breach Notifications (June 2023): we collect the basic facts, contain the breach, assess the risk of harm, consider notification, and keep a record of the incident and the remedial steps taken.
Notification of a data breach to the PCPD is not currently a statutory requirement in Hong Kong. However, as a recommended practice, where a breach involves personal data and is likely to result in a real risk of harm to the individuals concerned, we will, as soon as practicable after becoming aware of it, notify the PCPD and the affected individuals, and take reasonable steps to mitigate the harm.
Under the PDPO you have the right to:
Requests should be made in writing to freeeim@gmail.com. To protect your data, we may ask you for information to verify your identity and to locate the data.
The Services are not designed for children. If you are under 18 years of age, you should use the Services only with the consent of a parent or guardian who agrees to our Terms of Service on your behalf, and you should not purchase paid Services. If you are a parent or guardian and believe that a minor has provided personal data to us, please contact us and we will take reasonable steps to delete it.
Under section 64 of the PDPO, as amended by the Personal Data (Privacy) (Amendment) Ordinance 2021, it is a criminal offence to disclose personal data without the relevant consent where the disclosure is intended to cause, or is reckless as to whether it causes, "specified harm" (which includes harassment, intimidation, threats, physical or psychological harm, and damage to property) to the data subject or a member of the data subject's family. We do not tolerate the use of the Services for doxxing, harassment, cyberbullying or any similar conduct, and we may suspend or terminate accounts and report such conduct to the PCPD or the police.
The Services may contain links to, or rely on, websites, plug-ins and applications operated by third parties (for example, payment providers, login providers and analytics providers). We do not control those third parties, and their handling of your personal data is governed by their own privacy policies. We encourage you to read them.
We may update this Policy from time to time to reflect changes in our practices, the Services or the law. The updated Policy will be posted on this page with a new "Last updated" date. Where a change is material, we will take reasonable steps to bring it to your attention, such as a notice on the website. Your continued use of the Services after the updated Policy takes effect constitutes your acknowledgement of the updated Policy.
This Policy is governed by the laws of the Hong Kong Special Administrative Region. Nothing in this Policy limits any right you have under the PDPO or any other applicable law that cannot be excluded or limited.
This Policy is issued in English, which is the governing version. If we make any translation of this Policy available, the English version prevails to the extent of any inconsistency.
For any question, request or complaint about privacy or personal data, please contact freeeim@gmail.com. We will acknowledge your message and respond as soon as practicable. You also have the right to complain to the Office of the Privacy Commissioner for Personal Data (PCPD) at www.pcpd.org.hk.