LEGAL GrowingX
隐私说明（简明版）
Last Updated: August 16, 2026 · Effective Date: August 16, 2026
中文Document Version: 2026.08.16.1
Last Updated: August 16, 2026
Effective Date: August 16, 2026
Current status: Engineering compliance draft pending external counsel's written sign-off on this exact version and SHA-256. This document is not lawyer-approved.
This Notice only helps you understand the key points. It does not replace, reduce, or alter the full Privacy Policy. If this Notice is inconsistent with the full Policy, the full Chinese Policy and mandatory law prevail.
Chengdu Hanxi Technology Co., Ltd. provides the GrowingX / GrowingX-G SaaS tools and is not a training organization.
We process only information necessary for account authentication, permissions, enabled functions, support, security, and legal obligations. The full Policy and just-in-time notices describe the specific categories, purposes, legal bases, and retention periods. Non-essential marketing, analytics, sensitive permissions, or new purposes may not be bundled with the core Service.
Users under 18 may not self-register; an Organization must invite them and a Guardian must complete verification and authorization. All personal information of a Child under 14—including phone numbers, device information, logs, order/session-consumption data, and push identifiers—is sensitive personal information and is governed by the Children's Personal Information Protection Policy.
An SMS one-time password proves only that the applicant controls the relevant phone number; it does not by itself prove a guardianship relationship. Guardian authorization must also include a guardianship declaration and matching against the Organization's existing records, with enhanced verification for disputed, anomalous, or high-risk cases.
Camera, photo-library, microphone, location, notification, and similar permissions are requested by scenario only for actual functions and to the minimum extent necessary. Refusing a non-essential permission does not affect other basic functions. An SDK, plug-in, or external supplier may process production personal information only after its production configuration, contracting entity, data fields, processing location, and contractual duties have been verified and the required notice has been provided.
See the current public Supplier and Subprocessor List. A supplier that is not listed or has not been verified may not process production personal information.
Anonymization means irreversible processing, supported by a re-identification risk assessment, after which a specific person cannot be identified and the data cannot be restored; the resulting data is no longer personal information. De-identified data may still be re-identified and remains personal information; de-identified Organization-Controlled Data remains subject to the DPA and the Organization's instructions.
Training a model with identifiable personal information, sensitive personal information, or Children's personal information requires an independent lawful basis, the applicable separate notice, separate consent or Guardian consent, and a convenient opt-out mechanism. Service terms, a general DPA instruction, or de-identification alone is not sufficient.
You may lawfully request access, a copy, correction, supplementation, deletion, an explanation of processing rules, withdrawal of consent-based processing, account deletion, and the applicable rights concerning automated decision-making. For Organization-Controlled Data, contact the relevant Organization first; we will assist within the scope of the DPA. We generally respond within 15 business days after identity verification, unless law provides otherwise.
(End)