Privacy Policy隐私政策

This Privacy Policy explains how Yuanyun Technology (圆蕴科技) ("Yuanyun Technology", "we", "us", or "our") collects, uses, shares, and protects information in connection with our software-as-a-service platform, Roundluck (app.roundluck.com), and related websites and applications (collectively, the "Service"). The Service helps Chinese manufacturers market to and communicate with overseas B2B customers, including through a unified messaging inbox that connects Facebook Messenger, Instagram, and WhatsApp.

1. Who we are & how to contact us

The Service is operated by Yuanyun Technology (圆蕴科技).

• Legal company name: 佛山圆蕴科技有限公司 (Foshan Yuanyun Technology Co., Ltd.)
• Registered address: 佛山市禅城区石湾镇街道魁奇西路宝利莱装饰材料城B座三楼303房Q180室, Foshan, Guangdong, China
• Unified Social Credit Code: 91440604MAEQY88L66
• Contact email: potterhuhu@gmail.com
• Website: roundluck.com

If you have any questions about this policy or about how your data is handled, please contact us at the email above.

2. What data we collect

(a) Account data of our business users

When a business signs up for and uses the Service, we collect account and profile information such as name, business name, email address, login credentials, billing details, and configuration settings, as well as usage and log data (for example, IP address, device and browser information, and actions taken within the Service) needed to operate and secure the product.

(b) Messaging data from connected channels

When a business connects their Facebook Page (Messenger), Instagram professional account, or WhatsApp to the Service, we receive the messages that the business's customers send to that business. This may include:

• Message content (text, and any attachments such as images, files, or other media sent in the conversation);
• The sender's name and platform-scoped identifier (such as a Facebook Page-Scoped ID (PSID) or Instagram-Scoped ID (IGSID)) and, for WhatsApp, the phone number used to contact the business;
• Message timestamps and basic conversation metadata.
• Messages the business itself sends in these conversations, including messages its team sends directly from the Messenger, Instagram or WhatsApp Business apps; and, when a business connects a number it uses in the WhatsApp Business app (coexistence), the recent chat history the business chooses to sync (up to about six months) and the names the business has saved for its contacts in that app.

We receive and process this messaging data to display the messages in the connecting business's inbox and to enable that business to reply, and for the other features described in section 4 that the business chooses to use (such as AI-assisted and automatic replies, translation, and voice-message transcription). If the business turns on the advertising tools described in section 10(c), only the limited data listed there is sent to that business's own ad accounts and datasets. Message content, customer names and profile pictures are never sent to any advertising platform. The business is the controller of its own customers' messages; we act as a processor that provides the inbox service on the business's behalf.

(c) Access tokens and account identifiers

To receive and send messages on a business's behalf, we store the Facebook / Instagram Page access tokens, and the page, account, and business identifiers, that the business authorizes during connection. These tokens are used only to provide that business the services described in this policy, such as its inbox and the publishing features in section 10(a), and are protected as described in the Security section. When a person signs in with Facebook to connect a Page, the user access token that Facebook issues for this sign-in is used only during that connection step and is not stored, and from that person's Facebook profile we read only their app-scoped Facebook user ID — not their name, profile picture or email. We store this ID with the connections that person made, and also in a connection log (together with the list of Pages that Facebook returned) that we use to troubleshoot failed connections. We use this ID only to record who authorized each connection, to troubleshoot connections, and to act on the app removals and data deletion requests that Meta sends us for that person; when Meta sends us a data deletion request for that person, we also delete their connection log entries. If a Meta ad account is connected to a business's workspace, we also store an access token for that ad account connection; it is used only for section 10(c), and when that ad account is disconnected we delete that stored token and stop retrieving data from the ad account.

For WhatsApp, we store the access token and the WhatsApp Business Account and phone number identifiers that the business authorizes when it connects a number. If a business sets up conversion reporting (section 10(c)), we store the Meta dataset IDs and access tokens used to send its events, including, for each connected WhatsApp number, a copy of that number's access token for the dataset of its WhatsApp Business Account. When Meta sends us a data deletion request, we keep a record of that request (the user ID Meta sent, the confirmation code, its status and a summary of what was deleted) so that the request can be tracked and we can show that it was handled.

(d) Advertising data

When a customer starts a conversation by tapping one of the business's click-to-message ads, Meta includes information about that ad with the message (such as the ad ID, headline, text, image or video, and an ad click ID), and we store it with that conversation, including a copy of the ad's image or video thumbnail so the business can see which ad the customer came from. If a business connects its Meta ad accounts or turns on the advertising tools described in section 10(c), we also receive and store that business's ad account details and ad performance figures, and a record of the conversion events we sent for it.

3. Cookies and similar technologies

We — and, for the embedded third-party content described in (b) below, those third parties — store, access and collect information on and from your device, including by placing, reading or recognising cookies, browser local storage and similar technologies in your browser. This section explains what is stored, why, and how you can control it.

(a) What Roundluck stores on your device

The Roundluck platform (app.roundluck.com) and this website (roundluck.com) use your browser's local storage for strictly functional purposes:

• Keeping you signed in — when you sign in to the platform we store your session token in local storage, so you are not asked to sign in again on every page. It is removed when you sign out.
• Remembering your settings — for example the interface language you selected on this website, the workspace you last worked in, and which panels, filters and options you had open, so the product looks the same when you return.
• Remembering your sign-in name — after you sign in successfully, the platform remembers on that browser the main account name you used, so the sign-in page is pre-filled next time. It never stores your password or your sub-account name. It is kept after you sign out; you can remove it by clearing this site's data in your browser.

On our own websites and in the platform, we do not use cookies, local storage or similar technologies for advertising, ad targeting, ad measurement, or to track you across other websites, and we do not run third-party analytics or advertising tags there.

(b) Third-party content we embed, including the YouTube embedded player

Parts of the Service display content that is served directly by the platform it comes from. When that content loads, your browser connects to that third party, which can set and read its own cookies and similar identifiers on your device and receive information such as your IP address, browser and device type, and the page you were viewing. This happens under that third party's own privacy policy:

• YouTube embedded player (Google LLC). In our market-research feature you can preview a publicly available YouTube video without leaving the Service. The video is played by the YouTube embedded player loaded from youtube.com, and Google may place and read cookies and similar technologies on your device through that player. Use of the embedded player is subject to the YouTube Terms of Service and the Google Privacy Policy; see also how Google uses information from sites or apps that use its services.
• TikTok embedded player (TikTok Pte. Ltd.). Previews of publicly available TikTok videos are played by TikTok's embedded player loaded from tiktok.com, which may likewise set and read cookies and similar identifiers on your device.
• Thumbnails and images shown in search and preview results are loaded from the source platforms' own content networks (for example i.ytimg.com for YouTube thumbnails). Loading them sends a request from your browser to that network, which receives your IP address and browser information.
• Google Fonts. Our public website loads web fonts from fonts.googleapis.com and fonts.gstatic.com; Google receives that request, including your IP address, in order to serve the font files.
• Facebook JavaScript SDK (Meta Platforms, Inc.). When a business user opens the AI Customer Service page of the platform, we load Meta's JavaScript SDK from connect.facebook.net so the business can connect its WhatsApp Business account through Meta's own sign-up window. Meta may set and read its own cookies on your device through it, under Meta's own privacy policy.

(c) How you can control this

You can block or delete cookies and clear local storage at any time in your browser settings, and most browsers allow you to refuse third-party cookies specifically. Blocking the storage used by embedded players affects only those players — the rest of the Service continues to work. Blocking the storage the platform itself uses will sign you out and reset your saved preferences, because that storage is what keeps you signed in. You can also control what Google associates with your Google Account in your Google Account privacy settings.

4. How we use data

We use the data described above to:

• Deliver the unified inbox — receiving, organizing, and displaying customer messages from connected channels;
• Enable replies — allowing the business's team members to respond, with AI-assisted reply suggestions to help them respond faster and more clearly, and, where the business turns it on, an AI assistant that replies to customers automatically on the business's behalf, sends follow-up messages and hands the conversation to a team member when needed;
• Generate marketing content (such as social copy, content calendars, and product images) that the business requests;
• Translate messages between the customer's language and the team's language, convert voice messages in conversations to text, describe the images and videos customers send, summarize conversations for the business, and automatically classify conversations (for example by inquiry type, buying intent, language or spam) so the business can prioritize them;
• Show the business how its own ads perform and, where the business turns them on, provide the advertising tools described in section 10(c) for that business's own ad accounts;
• Provide customer support, maintain and secure the Service, prevent abuse, and comply with legal obligations.

5. Third-party processors

We rely on a limited number of service providers ("sub-processors") to operate the Service. They process data only on our instructions and only as needed to deliver the Service:

• AI model providers (including AI routing services that pass our requests on to the model provider we select) — to generate AI-assisted and automatic replies, translate messages, convert voice messages to text, describe images and videos, summarize and classify conversations, and generate marketing content. For these purposes, relevant message text, images, videos and voice recordings, the business's own product information and, where relevant, the customer's name and a short customer summary may be transmitted to and processed by these providers. We do not permit such content to be used to train third-party models where that option is available to us.
• Messaging channel service providers — for businesses that connect a WhatsApp number through such a provider instead of directly through Meta, to send and receive WhatsApp messages on the business's behalf; the provider processes the customer's phone number and the message content and media.
• Social media publishing service providers — publishing services that post the content a business submits to the social accounts the business connects through them (TikTok publishing is provided this way; see section 10.2).
• Media processing service providers — to create voice-overs, subtitles, lip-sync and video or image edits from the media a business uploads for its own marketing content.
• Search, data-enrichment and email-verification providers — for the market-research and buyer-research features a business chooses to use: the search terms the business enters (which may include a company name, a person's name, a website, a phone number or an email address) are sent to these providers to find publicly available information or to check whether an email address is valid.
• Cloud hosting and infrastructure providers — to host the Service on servers in the United States, and to provide network security, an encrypted tunnel, content delivery, file storage (including the files, images, videos and voice recordings exchanged in conversations) and backups. These providers store data and help us deliver the application securely.

In addition, when a business connects its own accounts on the following platforms, we exchange data with those platforms on the business's behalf to provide the features it uses. Each of these platforms processes that data under its own terms and privacy policy:

• Meta Platforms, Inc. — to receive and send messages on the business's behalf via the Meta / Facebook Graph API across Messenger, Instagram, and WhatsApp, and, for businesses that use them, to provide the advertising tools described in section 10(c) through the Meta Marketing API and Conversions API.
• Google LLC (YouTube API Services) — to upload videos to the business's own YouTube channel when the business connects its Google account and requests a publish, and to read the public view, like and comment counts of the videos published that way (see §10.1).
• TikTok Pte. Ltd. — to publish content to the business's own TikTok account when the business connects its TikTok account and requests a publish.
• LinkedIn Corporation — to publish content to the business's own LinkedIn profile or LinkedIn Page when the business connects its LinkedIn account and requests a publish.

6. Data sharing

We share data only: (i) with the sub-processors listed above, and with the platforms a business connects, as described in section 5; (ii) with the business that connected the channel, whose customers' messages are displayed in that business's own inbox; (iii) where required by law, legal process, or to protect rights, safety, and the integrity of the Service; (iv) in connection with a corporate transaction (such as a merger or acquisition), subject to this policy; and (v) at a business's direction, with Meta, into that business's own ad accounts and datasets, as described in section 10(c). We do not sell or rent personal data to third parties.

7. Data retention

We retain account data and messaging data while the business's account is active, as needed to provide the Service. Data is deletable on request. When a business disconnects a channel, we delete the access token stored for that channel (for a WhatsApp number, also the copy kept for conversion reporting, unless another number the business still has connected belongs to the same WhatsApp Business Account) and ask Meta to stop sending us that channel's updates; conversation history already received stays in that business's inbox until the business asks us to delete it. When a business disconnects an ad account, we delete the access token stored for it and stop retrieving data from that ad account immediately; ad performance figures already retrieved stay in that business's report history until it asks us to delete them. To close an account and have all of its data deleted, a business can contact us as described in our Data Deletion instructions. We also keep a technical log of platform notifications that our system could not process normally (for example, a message that arrives for a Page or account that is no longer connected to our platform), so that lost messages can be found and recovered. This log is not shown in the inbox and is not removed by the automatic deletion described in section 10. All of this is subject to limited retention in backups and where required for legal or security purposes.

8. Security

We apply administrative, technical, and organizational safeguards designed to protect data against unauthorized access, disclosure, alteration, and loss. These include encryption in transit, access controls, restricted handling of access tokens, and monitoring. No method of transmission or storage is completely secure, but we work to protect your information and to promptly address any issues we identify.

9. Your rights & data deletion

Depending on your location, you may have rights to access, correct, export, restrict, or delete your personal data, and to object to certain processing. Business users and end customers can request deletion of their data at any time. End customers may also contact the business they messaged.

To exercise any of these rights, email potterhuhu@gmail.com or follow the steps in our Data Deletion instructions.

10. Meta Platform compliance

We adhere to the Meta Platform Terms and the Meta Developer Policies. Data we obtain through Meta's APIs (the Graph API for Facebook Pages and Instagram) is used only to provide the services described below to the business that connected its own accounts.

(a) Content publishing. When a business connects its Facebook Page and Instagram professional account, we read the list of Pages that the business chooses to share with us in Facebook's authorization window and connect those Pages, and we publish to that business's own Page and Instagram account only the content that business has created and approved inside our platform — either immediately, or at the date and time that business schedules. Drafts may be AI-assisted. Content goes out either after the business approves that individual post, or automatically according to a content plan and schedule the business has set up in our platform. After publishing we read the post identifier and its publication status, so the business can see inside our platform whether its post went out successfully. Post performance and comments. For posts published through our platform, we read that post's own performance figures (such as views, reach, likes, comments, shares and saves) and show them back to that business inside our platform, so it can see how its own content performed. In the past, where a business had enabled it, we received notifications of new comments left on that business's own Page or Instagram posts, and stored the comment content and the commenter's name and ID in that business's records. We no longer store or use these comment notifications: any that still reach us are discarded on arrival without being stored. Comments stored before this change are not displayed or used in our platform, and the business can ask us to delete them. We read post performance figures only for the business's own posts and only to show them back to that business, and we do not use any of the data described in this paragraph for advertising or ad targeting, do not sell it, and do not use it to train third-party models.

(b) Messaging. When a business connects its Facebook Page or Instagram professional account, we receive the messages that people send to that Page or account and display them in that business's inbox, so its team can read and reply to them in one place, together with the inbox features described in section 4 that the business chooses to use (such as AI replies, translation and voice-message transcription). When a person starts a new conversation, we ask Meta for that person's name so the business's team can see who it is talking to, and we store it with that conversation and in that business's customer records, together with the person's Page-scoped or Instagram-scoped ID. The name may also appear in records created from that conversation for the business's team, such as tasks and deal summaries. For Messenger conversations that started before this feature was available and still have no name, we make the same request once.

(c) Advertising tools the business chooses to use. Some businesses use our platform to see how their own Meta ads perform and to report results back to their own Meta ad accounts. These tools work only with ad accounts, Pages, Instagram accounts and WhatsApp Business accounts that the business owns or has been granted access to by their owner; they run only when that business connects or turns them on; and what we produce from them is shown only to that business.

• Ad performance reports. When an ad account is connected, we use the Meta Marketing API to read that ad account's name, currency, time zone and status; the names, statuses and objectives of its campaigns, ad sets and ads; and daily ad-level performance figures (such as spend, impressions, reach, clicks, CTR, CPM and the results Meta reports). Together with the ad information Meta includes with messages that start from the business's ads, we use this only to show that business which of its own ads brought which conversations and what they cost. These are aggregate advertising figures and do not identify the people who saw the ads.
• Conversion events. If the business turns on conversion reporting, we send conversion events (such as "LeadSubmitted", "QualifiedLead" or "Purchase") through the Meta Conversions API to the Meta dataset that the business has set up for its own Page, Instagram account or WhatsApp Business account. Meta uses these events to measure and optimize that business's own ads.
  • When an event is sent: when a conversation reaches a point the business has chosen to report — for example, when a member of its team marks a conversation as a qualified lead and confirms, when the business moves a customer to a follow-up stage it has chosen to report, when the business records a sale, or when our system assesses the conversation as a genuine inquiry under the lead settings the business has chosen. Events about customers who contacted the business on Messenger or Instagram are sent only if the business has turned reporting on for that channel (it is off by default) or a member of its team marks that conversation and confirms.
  • How the customer is identified: for Messenger, by the Page ID and the customer's Page-scoped ID (PSID); for Instagram, by the related Page ID or Instagram professional account ID and the customer's Instagram-scoped ID (IGSID); for WhatsApp, by the customer's phone number hashed with SHA-256 and, if the conversation started from an ad, the ad click ID that Meta supplied and the WhatsApp Business Account ID or the related Page ID.
  • What an event contains: the event name and time and an event reference number, and possibly a hashed internal customer reference, a short label of what triggered it, the lead grade, inquiry category or follow-up stage that the business or our system assigned, and, where the business recorded them, the product name, the sale date, and the sale value and currency. Events never contain message content, customer names or profile pictures. We keep a record of each event we sent, so the business can see what was reported and failed sends can be retried.

Apart from the advertising tools in (c), which run only for the business's own ad accounts and datasets and only at that business's direction, we do not use Meta data for advertising or ad targeting. Messenger and Instagram identifiers are never sent to any advertising platform other than Meta, as described in (c), and message content, customer names and profile pictures are never sent to any advertising platform. We do not sell Meta data, do not use it to train third-party models, do not disclose one business's data to any other business, do not build advertising profiles of our own, and do not transfer it except to the sub-processors and for the limited purposes described in this policy. Customer names received through Meta are used only to provide the Service to the business that received the message — mainly to show its own team who it is talking to. When a business disconnects a channel, we delete the Meta access token stored for that channel, including, for a WhatsApp number, the copy kept for conversion reporting (unless another number the business still has connected belongs to the same WhatsApp Business Account). The related messaging data is deleted when the business asks us to (see our Data Deletion instructions). When Meta sends us a data deletion request for the person who authorized a Facebook or Instagram connection, we automatically delete, for each such connection that is still in our system (including one that was only disconnected by removing our app in Facebook), its access token and its conversations and messages, including the stored copies of attachments received through Meta that are still linked to those messages; if a channel was disconnected inside our platform (even if it was connected again later), the conversations received before it was disconnected may no longer be matched this way, so please also email us in that case. Copies of a customer's name in tasks and deal summaries are not removed by this automatic process; email us to have them deleted. If a business removes our app in its Facebook settings, the access it gave us stops working and we mark the connections it authorized as disconnected. A business can revoke our access at any time in its own Facebook settings; once revoked, we can no longer publish to, or receive messages from, its accounts.

10.1 YouTube API Services & Google user data

Roundluck uses YouTube API Services. By connecting a Google account, you agree to be bound by the YouTube Terms of Service. The Google Privacy Policy also applies.

What we access, use, store and share: when a business connects its Google account, we request only the permission to upload videos to that business's own YouTube channel, plus basic Google sign-in information (name and profile picture) so we can show which Google account is connected. We store the OAuth tokens securely and use them solely to upload the videos the business explicitly asks us to publish, and to show the upload result. For the videos published this way, we also read their public view, like and comment counts through the YouTube Data API (public data only; no additional permission is requested) and show them back to that business inside our platform, so it can see how its own videos performed. We do not read the connected channel's analytics, subscriber lists, private videos or other non-public data; we do not share Google user data with third parties except the infrastructure sub-processors listed above; and we never sell it.

Separately, our market-research features use the YouTube Data API with an API key, not any connected Google account, to read publicly available YouTube data — search results, public channel and video information, and public comments, including the commenter's public display name — to help businesses understand their market.

Deletion and refresh: stored Google authorization data is refreshed or deleted at least every 30 days; the view, like and comment counts we store for those videos are refreshed daily and deleted if they cannot be refreshed within 30 days (for example, when a video is deleted or made private); tokens are deleted immediately when the business disconnects the channel or on request (see Data Deletion).

Revoking access: in addition to disconnecting inside Roundluck, you can revoke Roundluck's access to your Google data at any time via the Google security settings page at https://security.google.com/settings/security/permissions.

10.2 TikTok data

TikTok publishing is provided through a social media publishing service provider that we use (see section 5); its name is shown on the TikTok authorization screen. When a business connects TikTok, it authorizes that provider's TikTok app; the provider holds the resulting TikTok access token, which we do not store, and publishes only the content the business explicitly submits, to that business's own TikTok account. We receive the connected account's basic profile (username, display name and avatar), each post's publishing status, and its public view, like, comment and share counts, and show them only to that business. A business can disconnect the account in our platform, and can revoke the provider's access at any time in its TikTok settings. TikTok access tokens from accounts that were connected to us directly before October 2026 are deleted when the account is disconnected or on request.

10.3 LinkedIn data

When a business connects a LinkedIn account or LinkedIn Page, we access only what is needed to identify which account or Page the content will be published to, and we publish only the content the business explicitly submits, to that business's own LinkedIn profile or Page. In line with the LinkedIn API Terms of Use, we do not retain LinkedIn member profile data (such as name or profile picture) beyond 24 hours, and we do not retain LinkedIn member social action data beyond 48 hours; our records keep only the LinkedIn identifier (URN) of the connected account and the access token needed to publish on the business's behalf. We do not use LinkedIn data for advertising, profiling, resale, or to build any independent database of members. Stored LinkedIn access tokens are deleted when the channel is disconnected or on request, and the business can also revoke our access at any time from its LinkedIn account settings.

11. Children

The Service is a business tool intended for organizations and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us so we can delete it.

12. International transfers

We operate internationally, and data may be processed in countries other than the one in which you are located, including where our sub-processors operate. Where required, we use appropriate safeguards for such transfers.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the effective date above. Material changes will be communicated as appropriate. Your continued use of the Service after an update constitutes acceptance of the revised policy.