Privacy Policy隐私政策

This Privacy Policy explains how Yuanyun Technology (圆蕴科技) ("Yuanyun Technology", "we", "us", or "our") collects, uses, shares, and protects information in connection with our software-as-a-service platform and related websites and applications (collectively, the "Service"). The Service helps Chinese manufacturers market to and communicate with overseas B2B customers, including through a unified messaging inbox that connects Facebook Messenger, Instagram, and WhatsApp.

1. Who we are & how to contact us

The Service is operated by Yuanyun Technology (圆蕴科技).

• Legal company name: 佛山圆蕴科技有限公司 (Foshan Yuanyun Technology Co., Ltd.)
• Registered address: 佛山市禅城区石湾镇街道魁奇西路宝利莱装饰材料城B座三楼303房Q180室, Foshan, Guangdong, China
• Unified Social Credit Code: 91440604MAEQY88L66
• Contact email: [email protected]
• Website: roundluck.com

If you have any questions about this policy or about how your data is handled, please contact us at the email above.

2. What data we collect

(a) Account data of our business users

When a business signs up for and uses the Service, we collect account and profile information such as name, business name, email address, login credentials, billing details, and configuration settings, as well as usage and log data (for example, IP address, device and browser information, and actions taken within the Service) needed to operate and secure the product.

(b) Messaging data from connected channels

When a business connects their Facebook Page (Messenger), Instagram professional account, or WhatsApp to the Service, we receive the messages that the business's customers send to that business. This may include:

• Message content (text, and any attachments such as images, files, or other media sent in the conversation);
• The sender's name and platform-scoped identifier (such as a Facebook Page-Scoped ID (PSID) or Instagram-Scoped ID (IGSID)) and, for WhatsApp, the phone number used to contact the business;
• Message timestamps and basic conversation metadata.

We receive and process this messaging data solely to display the messages in the connecting business's inbox and to enable that business to send replies. The business is the controller of its own customers' messages; we act as a processor that provides the inbox service on the business's behalf.

(c) Access tokens and account identifiers

To receive and send messages on a business's behalf, we store the Facebook / Instagram Page access tokens, and the page, account, and business identifiers, that the business authorizes during connection. These tokens are used only to operate the inbox for that business and are protected as described in the Security section.

3. How we use data

We use the data described above to:

• Deliver the unified inbox — receiving, organizing, and displaying customer messages from connected channels;
• Enable replies — allowing the business's team members to respond, and generating AI-assisted reply suggestions to help them respond faster and more clearly;
• Generate marketing content (such as social copy, content calendars, and product images) that the business requests;
• Provide customer support, maintain and secure the Service, prevent abuse, and comply with legal obligations.

4. Third-party processors

We rely on a limited number of service providers ("sub-processors") to operate the Service. They process data only on our instructions and only as needed to deliver the Service:

• Meta Platforms, Inc. — to receive and send messages on the business's behalf via the Meta / Facebook Graph API across Messenger, Instagram, and WhatsApp.
• Google LLC (YouTube API Services) — to upload videos to the business's own YouTube channel when the business connects its Google account and requests a publish.
• TikTok Pte. Ltd. — to publish content to the business's own TikTok account when the business connects its TikTok account and requests a publish.
• LinkedIn Corporation — to publish content to the business's own LinkedIn profile or LinkedIn Page when the business connects its LinkedIn account and requests a publish.
• OpenAI — to generate AI-assisted reply suggestions and marketing content. To draft a suggested reply, relevant message text may be transmitted to and processed by OpenAI. We do not permit such content to be used to train third-party models where that option is available to us.
• Cloud hosting and infrastructure providers — to host the Service, store data, and deliver the application securely.

5. Data sharing

We share data only: (i) with the sub-processors listed above; (ii) with the business that connected the channel, whose customers' messages are displayed in that business's own inbox; (iii) where required by law, legal process, or to protect rights, safety, and the integrity of the Service; and (iv) in connection with a corporate transaction (such as a merger or acquisition), subject to this policy. We do not sell or rent personal data to third parties.

6. Data retention

We retain account data and messaging data while the business's account is active and the relevant channel remains connected, as needed to provide the inbox service. Data is deletable on request, and messaging data and stored access tokens for a channel are deleted when the business disconnects that channel or closes its account, subject to limited retention required for legal, security, or backup purposes. See our Data Deletion instructions for details.

7. Security

We apply administrative, technical, and organizational safeguards designed to protect data against unauthorized access, disclosure, alteration, and loss. These include encryption in transit, access controls, restricted handling of access tokens, and monitoring. No method of transmission or storage is completely secure, but we work to protect your information and to promptly address any issues we identify.

8. Your rights & data deletion

Depending on your location, you may have rights to access, correct, export, restrict, or delete your personal data, and to object to certain processing. Business users and end customers can request deletion of their data at any time. End customers may also contact the business they messaged.

To exercise any of these rights, email [email protected] or follow the steps in our Data Deletion instructions.

9. Meta Platform compliance

We adhere to the Meta Platform Terms and the Meta Developer Policies. Data obtained through Meta (Messenger, Instagram, and the Graph API) is used only to provide the unified inbox service to the business that connected its account — to receive, display, and reply to that business's own customer messages. We do not use Meta data for advertising, do not sell it, and do not transfer it except to the sub-processors and for the limited purposes described in this policy.

9.1 YouTube API Services & Google user data

Roundluck uses YouTube API Services. By connecting a Google account, you agree to be bound by the YouTube Terms of Service. The Google Privacy Policy also applies.

What we access, use, store and share: when a business connects its Google account, we request only the permission to upload videos to that business's own YouTube channel. We store the OAuth tokens securely and use them solely to upload the videos the business explicitly asks us to publish, and to show the upload result. We do not read channel analytics, subscriber lists, or other YouTube data beyond what is needed for the upload the user requested; we do not share Google user data with third parties except the infrastructure sub-processors listed above; and we never sell it.

Deletion and refresh: stored Google authorization data is refreshed or deleted at least every 30 days; tokens are deleted immediately when the business disconnects the channel or on request (see Data Deletion).

Revoking access: in addition to disconnecting inside Roundluck, you can revoke Roundluck's access to your Google data at any time via the Google security settings page at https://security.google.com/settings/security/permissions.

9.2 TikTok data

When a business connects its TikTok account, we access only the basic profile information (open id, display name, avatar) needed to show which account is connected, and we publish only the content the business explicitly submits, to that business's own TikTok profile. Stored TikTok access tokens are deleted when the channel is disconnected or on request.

9.3 LinkedIn data

When a business connects a LinkedIn account or LinkedIn Page, we access only what is needed to identify which account or Page the content will be published to, and we publish only the content the business explicitly submits, to that business's own LinkedIn profile or Page. In line with the LinkedIn API Terms of Use, we do not retain LinkedIn member profile data (such as name or profile picture) beyond 24 hours, and we do not retain LinkedIn member social action data beyond 48 hours; our records keep only the LinkedIn identifier (URN) of the connected account and the access token needed to publish on the business's behalf. We do not use LinkedIn data for advertising, profiling, resale, or to build any independent database of members. Stored LinkedIn access tokens are deleted when the channel is disconnected or on request, and the business can also revoke our access at any time from its LinkedIn account settings.

10. Children

The Service is a business tool intended for organizations and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact us so we can delete it.

11. International transfers

We operate internationally, and data may be processed in countries other than the one in which you are located, including where our sub-processors operate. Where required, we use appropriate safeguards for such transfers.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the effective date above. Material changes will be communicated as appropriate. Your continued use of the Service after an update constitutes acceptance of the revised policy.