1. Introduction and Scope of Application
1.1 This Policy explains how the operator of the VarrMall platform, Qingdao Xiaotonghao Information Technology Co., Ltd. (the "Company", "we", "us" or "our"), collects, uses, stores, shares and protects your personal information when you visit our website, apply for a trial, register and sign in, and use the VarrMall Merchant Admin and related services (collectively, the "Services"), and the rights you hold.
1.2 This Policy applies to: website visitors, holders of a primary merchant account, and users of merchant employee sub-accounts.
1.3 Roles (important): The Services involve two categories of personal information, and our role differs in each case —
- Your account information, store operation information and usage logs: we are the Controller of such personal information and process it in accordance with this Policy;
- Personal information of your store's customers (order delivery information, customer support conversations, browsing and add-to-cart records, etc.): you are the Controller and we act only as a Processor engaged by you, processing such information on your instructions and under the Data Processing Agreement (DPA), and not for our own purposes. Customers should assert their rights against you; where a customer submits a request directly to us, we will refer it to you and assist you in responding.
1.4 Privacy notices on the storefront (cookie consent banners, privacy policy pages, etc.) are provided to customers by the merchant as the store operator. We provide the corresponding tools and templates, but the merchant is responsible for the final content and its compliance.
2. What Information We Collect
| Category | Specific information | Purpose of collection |
|---|---|---|
| Website visit information | Pages visited, referral source, browser and device information, masked IP address, time of visit | Website operation, visit statistics and experience optimisation |
| Account and identity information | Mobile phone number, email address, password (stored in encrypted form), name or nickname, role | Registration, sign-in and identity verification |
| Entity and qualification information | Name of the enterprise or sole proprietorship, registration number, legal representative, contact person, business licence and qualification materials required by the platform | Merchant onboarding review and compliance verification |
| Store operation information | Store name, logo, description, subdomain, custom domain, business categories, address, currency and language settings, payment and logistics channel configuration (keys stored in encrypted form) | Store creation, fulfilment and storefront display |
| Business operations data | Products and categories, orders, refunds, customer profiles, coupons, email templates, DIY pages and articles, image assets | Provision of the various business functions |
| Employee and permission information | Employee accounts, names, roles and permissions, operation records | Permission management and security auditing |
| Usage and device information | Sign-in time and IP address, operation logs, browser and device information, anomaly and risk-control records | Security protection, risk control and troubleshooting |
| Billing and usage information | Plans and invoices, payment transaction records, Token consumption details | Billing, reconciliation and customer support |
| AI interaction content | Customer support conversation content, text and images submitted for translation, GEO sampling keywords and results | Provision of AI capabilities and performance monitoring |
| Communication records | Enquiries and trial applications, support tickets, email and customer support correspondence | Pre-sales enquiries, support and dispute resolution |
2.2 We do not proactively collect sensitive personal information such as your identity card number, biometric information, precise location or financial account passwords. Where a business need genuinely requires it (for example, identity or qualification verification), we will separately inform you of the processing purpose and obtain your consent.
3. How We Use Information
| Purpose of processing | Description | Lawful basis |
|---|---|---|
| Provision and performance of the Services | Store creation and operation of product, order, marketing and other functions | Performance of a contract |
| Identity verification and account security | Registration, sign-in, password reset, risk control and anomaly detection | Performance of a contract / Legitimate interest |
| Billing and invoicing | Plan and Token billing, reconciliation | Performance of a contract / Legal obligation |
| Notifications and service messages | Verification codes, plan expiry reminders, security alerts | Performance of a contract / Legitimate interest |
| Service improvement and statistics | Analysis of feature usage in aggregate or de-identified form | Legitimate interest |
| Compliance and dispute resolution | Cooperation with regulatory and judicial requirements, handling of complaints and disputes | Legal obligation / Legitimate interest |
| Marketing and product recommendations | Delivery of information about new features and offers | Consent (opt out at any time) |
3.2 We do not use your personal information for automated decision-making that produces a material impact on you. You must review AI-generated output before using it.
4. How We Share, Process on Entrustment and Disclose Information
4.1 We do not sell your personal information. We share information or entrust its processing only in the following circumstances:
| Category | Recipient | Purpose | Information involved |
|---|---|---|---|
| Cloud and storage services | Alibaba Cloud (including object storage and image services) | Data storage, backup and image distribution | The categories of data listed in Section 2 of this Policy |
| AI model services | OpenAI, Google (Gemini), Perplexity, Alibaba Cloud Model Studio (Qwen), DeepL | Provision of translation, AI Customer Support, image processing and GEO sampling capabilities | Text and image content you submit, GEO sampling keywords |
| Payment services | Alipay, and PayPal, Stripe or Airwallex under agreements you enter into yourself | Subscription collection and (if you enable it) storefront payment collection | Order amount, merchant ID and other necessary information; the platform does not have access to full bank card numbers or payment passwords |
| Communication services | SMS service providers, email service providers | Sending verification codes, expiry reminders and notifications | Mobile phone number, email address, necessary notification content |
| Analytics and diagnostic tools | Third-party analytics tools you configure yourself on your storefront (such as Microsoft Clarity) | Storefront traffic and visitor experience analysis | Collected by you on your storefront in accordance with your own notice obligations |
| Professional services and compliance | Audit, legal and accounting service providers, and regulatory and judicial authorities | Compliance, auditing and dispute resolution | Provided to the extent necessary |
4.2 Transfer notice for AI services: To provide AI translation, AI Customer Support, AI image processing and GEO optimisation, the text, images and related context you submit are transferred to the AI service providers listed above for processing. Please do not submit through the relevant features any sensitive information that you do not wish to be transferred to third parties or across borders.
4.3 In the event of a merger, division, reorganisation or transfer of assets, we may transfer your information and will require the successor to remain bound by this Policy; otherwise we will obtain your consent afresh.
4.4 We may disclose necessary information where required by law or where necessary to protect the lawful rights and interests of the platform, you or others.
5. Cross-Border Transfer
5.1 Our primary data storage and service deployment are located within mainland China.
5.2 Because we use overseas AI, payment or email services, some information may be transferred outside mainland China. We provide protection by entering into standard contractual clauses, selecting service providers with the requisite compliance qualifications and minimising the fields transferred. By using the relevant AI features, you acknowledge and consent to the necessary cross-border transfers described above; if you do not wish your information to be transferred abroad, please stop using the corresponding features.
6. Cookies and Similar Technologies
6.1 The cookies used on our website and in the Merchant Admin are predominantly strictly necessary:
- Sign-in state: the auth cookie (httpOnly, not readable by page scripts);
- Security: a cross-site request forgery (CSRF) protection token, used to validate write operations;
- Preferences: local preference settings such as interface language.
6.2 The Merchant Admin does not use marketing cookies for cross-site advertising, and we do not embed third-party advertising tracking scripts in the Merchant Admin.
6.3 Storefront (facing customers): the platform provides a cookie consent component that obtains consent separately for three categories — "Strictly necessary / Functional / Marketing". Strictly necessary cookies are set without consent; functional and marketing cookies are disabled by default and are set only after the customer gives explicit consent. Customers may review and change their choices at any time through the "Cookie Settings" entry on the storefront. We record consents and refusals (including timestamp, masked IP address and the type of choice, retained for 24 months) as evidence of compliance.
6.4 You may delete or block cookies in your browser, but doing so may require you to sign in again or may prevent some features from working properly.
7. Retention of Information
7.1 We retain information for the following periods, after which it is deleted or anonymised:
| Data category | Retention period | Basis |
|---|---|---|
| Account and store operation data | For the service term; retained for 90 days after termination of the Services | Service restoration and data disposal rules |
| Order, payment and refund records (including customer transaction information) | 7 years, after which the personal information is anonymised | Financial and tax compliance |
| Plan and Token billing transaction records | 2 years after termination of the plan | Billing and auditing |
| AI Customer Support conversation records | 36 months; on expiry the original conversation text is deleted and only statistical data is retained | Data minimisation and privacy compliance |
| Token consumption logs | 24 months | Usage and billing verification |
| Operation and audit logs | 90 days | Security auditing |
| Notification delivery logs | 90 days | Delivery confirmation and troubleshooting |
| Cookie consent records (storefront) | 24 months | Retention of consent and evidence of compliance |
| Browsing and add-to-cart data of unregistered visitors (storefront) | No more than 30 days | Data minimisation |
| Personal data after account cancellation | Deleted or anonymised within 7 days | Response to user requests |
7.2 Where laws or regulations require a longer retention period, that requirement prevails; such data will be restricted to the statutory purposes.
8. How We Protect Information
8.1 Technical measures: HTTPS/TLS encryption in transit across the site; passwords stored using an irreversible encryption algorithm; payment and channel keys stored in encrypted form; multi-tenant data isolated at row level within the same database table by tenant identifier (tenant_id), with business queries mandatorily filtered by tenant; access control and least privilege in place; audit trails for key operations; and regular data backups.
8.2 Organisational measures: internal permission approval and access revocation upon departure, employee confidentiality requirements, and emergency response procedures for security incidents.
8.3 Security incidents: In the event of a security incident such as leakage, tampering with or loss of personal information, we will promptly take remedial measures and notify affected users and the competent authorities as required by law.
8.4 Please note that no system can guarantee absolute security. Please keep your account and password secure, and avoid weak passwords or sharing accounts among multiple people.
9. Your Rights
9.1 You hold the following rights in relation to your personal information:
- Access and copy: view your account, store and employee information in the Merchant Admin;
- Rectification and completion: amend inaccurate information yourself, or contact us to have it corrected;
- Export: export your store operation data; if you need a copy of your personal information, you may submit a request and we will respond within 72 hours;
- Deletion and account cancellation: apply to cancel your account; personal data will be deleted or anonymised within 7 days of cancellation;
- Withdrawal of consent: withdraw at any time from processing carried out on the basis of consent (such as marketing messages);
- Restriction of or objection to processing: request restriction of, or object to, specific processing in the circumstances provided by law;
- Complaint: lodge a complaint with a competent supervisory authority.
9.2 How to exercise your rights: through the relevant functions in the Merchant Admin, or by email to [email protected]. To protect security, we may ask you to complete identity verification first. We will reply within the period prescribed by law (generally no more than 15 business days).
9.3 Where your request concerns the personal information of your store's customers, we will assist you in handling it in accordance with the Data Processing Agreement; where a customer submits a request directly to us, we will refer it to you.
10. Minors
The Services are intended for business operators and not for minors under the age of 18, and we do not proactively collect the personal information of minors. If we discover any inadvertent collection, we will delete it promptly.
11. Updates to This Policy
11.1 We may update this Policy. In the event of material changes (such as changes to the purposes of processing, categories of information or recipients), we will announce them on our website or in the Merchant Admin and notify registered users by in-app notification or email; material changes are generally notified at least 7 days in advance.
11.2 You may review the latest version of this Policy and its update date on this page or in the Merchant Admin at any time.
12. Contact Us and Complaints
12.1 For enquiries, requests and complaints relating to personal information protection, please contact: [email protected]; you may also submit them through the feedback entry in "System Settings" in the Merchant Admin.
12.2 For brand and business cooperation, please contact: [email protected]; telephone: +86 156 6668 1179.
12.3 Mailing address: Floor 12, 7980-12 Lianyungang Road, Shibei District, Qingdao, Shandong, China.
12.4 If you consider that our processing has infringed your lawful rights and interests, you may complain to a competent supervisory authority or seek judicial remedies in accordance with law.
12.5 If you are a store customer, please first contact the store from which you placed your order; you may also contact us, and we will refer your request to the relevant merchant and assist in handling it.