Privacy Policy

1. Introduction & Role Definition

Shaoguan Liyu Technology Co., Ltd. (hereinafter referred to as "we", "us", or "Invx") operates the Invx Cross-Border E-Commerce Advertising Aggregation Platform (hereinafter referred to as "the Platform"). The Platform provides cross-border e-commerce sellers with one-stop services including advertising management, inventory linkage, creative asset management, profit reporting, WeChat notifications, and multi-role collaboration.

This Privacy Policy (hereinafter referred to as "this Policy") applies to the collection, use, storage, sharing, transfer, and protection of your personal information when you visit our official website, register for an account, and use our products and services. This Policy applies to both website visitors and registered users of the Platform.

Role Definition: In accordance with applicable laws, regarding the end-user information processed when you authorize the Platform to integrate with advertising channels such as TikTok, Google, and Meta, as well as e-commerce platforms such as Shopify, we act as a Processor, processing such information strictly based on your commissioned purpose and method. Regarding the registration information and contact information you actively submit, we act as a Controller.

Please read and fully understand the entire content of this Policy before using the Platform's services. Once you start using the Platform's services, you are deemed to have read, understood, and agreed to the personal information processing rules described in this Policy.

This Policy has been updated to comply with applicable data protection laws, including the Personal Information Protection Law of the People's Republic of China ("PIPL"), the EU General Data Protection Regulation ("GDPR"), the U.S. Children's Online Privacy Protection Act ("COPPA"), the California Consumer Privacy Act ("CCPA"), the Virginia Consumer Data Protection Act ("VCDPA"), the Colorado Privacy Act ("CPA"), the Connecticut Data Privacy Act ("CDPA"), the Utah Consumer Privacy Act ("UCPA"), and the Brazilian General Data Protection Law ("LGPD").

This Policy was last updated on July 27, 2026, and is effective from that date.

2. Information We Collect

To provide the Platform's services, we collect the following information during your registration and use of the services:

2.1 Registration Information

• Company information: company name, unified social credit code, business license photo
• Contact information: contact person's name, mobile phone number, WeChat ID, corporate email
• Business information: main platform, main product category, preferred channels

2.2 Channel Authorization Information

When you authorize the Platform to integrate with advertising channels such as TikTok, Google, and Meta, we collect and store the following information:

• Authorization credentials: channel authorization tokens (OAuth Token), ad account IDs, and other necessary credentials
• Advertising data: spend, impressions, clicks, conversions, revenue, retention, and other advertising behavior data
• Device identifiers: advertising-related device identifiers that may be returned by channel APIs (such as IDFA/GAID), which we use solely for storing channel report data and do not use for cross-channel tracking or user profiling
• Network information: IP address

2.3 Store Authorization Information

When you authorize the Platform to integrate with e-commerce platform stores such as Shopify, we collect and store store API credentials, SKU data, inventory data, order data, etc., for implementing inventory linkage and profit reporting features.

2.4 Creative Asset Information

When you use the creative asset library feature, we receive and store the images, videos, and other advertising creative files you upload, as well as the tags and group information you add to them.

2.5 Usage Data

During your use of the Platform, we automatically collect the following usage data:

• Operation logs: records of your operational behaviors within the Platform (such as ad start/stop, budget adjustment, creative replacement, etc.)
• Report data: advertising spend data synced from channel APIs, order and inventory data synced from store APIs, and cost data you manually enter
• Device and log information: access time, access IP, browser type, domain name, session duration, and other basic information

2.6 Sensitive Personal Information

Sensitive personal information refers to personal information that, once leaked or illegally used, may easily cause harm to the dignity of a natural person or endanger their personal or property safety. Without your valid consent, we will not collect your sensitive personal information. If you voluntarily provide sensitive personal information to us or through channel authorization, we will process it in strict accordance with applicable laws and the terms of this Policy.

3. How We Use Information

The information we collect will be strictly used for the following purposes:

• Providing core services: implementing advertising management, inventory linkage, creative asset management, profit reporting, WeChat notifications, multi-role collaboration, and other features
• Registration review: verifying company information and business licenses to complete the enterprise onboarding review process
• Channel and store integration: using authorization credentials to call third-party platform APIs such as TikTok/Google/Meta/Shopify
• Message push: pushing advertising, inventory, and exception alerts to you via WeChat Official Account
• Security and compliance: identity verification, access control, operation auditing, risk prevention, and compliance with regulatory requirements
• Service improvement: optimizing product features and improving service quality based on usage data
• Commercial communication and marketing: sending you product updates, event notifications, and other marketing information within the scope of your consent

We will not use your information for purposes other than those stated in this Policy. If we need to change the purpose of use, we will obtain your consent again.

4. Information Sharing, Commissioned Processing, Transfer, and Public Disclosure

4.1 Sharing

We solemnly commit: we will not sell your personal information to any third party. In the following circumstances, we will share your information within the necessary scope:

• Channel API integration: after your authorization, transmitting advertising operation commands, creatives, and other necessary data to advertising channels such as TikTok, Google, and Meta
• Store API integration: after your authorization, transmitting inventory sync commands and other necessary data to Shopify
• WeChat notification service: pushing alert messages to your WeChat via the WeChat Official Account API
• Payment channels: if you purchase a paid plan, sharing billing information with the payment service provider within the necessary scope
• Legal requirements: situations such as laws and regulations, litigation, mandatory requirements from government authorities

4.2 Commissioned Processing

To ensure the normal operation of services, we commission the following types of third parties to process your personal information:

• Cloud service providers: for data storage, computing, and system operation (see respective cloud service providers' privacy policies)
• SMS/email service providers: for sending verification codes, system notifications, etc.
• Customer service tool providers: for providing ticket support services

Other than the above-mentioned, we do not commission any other third parties to process your personal information. All commissioned processing is governed by data processing agreements, requiring third parties to protect your information to the same standard as this Policy.

4.3 Transfer

We will not transfer your personal information to any company, organization, or individual, except in the following circumstances:

• Having informed you of the types, purpose, method, and scope of the personal information to be transferred and obtained your separate consent;
• In cases involving mergers, divisions, dissolution, bankruptcy, etc., where personal information needs to be transferred, we will inform you of the recipient's name and contact information and require the recipient to continue fulfilling the obligations of the personal information controller. If the recipient changes the original processing purpose or method, we will require the recipient to obtain your consent again.

4.4 Public Disclosure

We will not publicly disclose your personal information, except in the following circumstances:

• Having informed you of the types, purpose, method, and scope of the personal information to be publicly disclosed and obtained your separate consent;
• Under circumstances of laws and regulations, legal proceedings, litigation, or mandatory requirements from government authorities.

5. International Data Transfers

As the Platform's services involve integration with overseas advertising channels such as TikTok, Google, and Meta, as well as overseas e-commerce platforms such as Shopify, some of your personal information (including authorization credentials, advertising data, order data, etc.) may be transferred to servers or third-party platforms located outside the People's Republic of China.

5.1 Cross-Border Transfer Scenarios

• Channel API calls: advertising operation commands and creative files transferred to TikTok (global), Google (United States), Meta (United States), etc.
• Store API calls: inventory sync commands transferred to Shopify (Canada), etc.
• Cloud services: data may be stored in data centers of overseas cloud service providers

5.2 Compliance Measures

• In accordance with Article 38 of the Personal Information Protection Law, we will complete cross-border transfer security assessments, standard contract filings, or obtain individual consent when necessary
• For users located in the European Economic Area (EEA), we have signed the EU Standard Contractual Clauses (SCC) to ensure data transfers comply with GDPR requirements
• We only transfer data to third-party platforms that have passed Privacy Shield or equivalent data protection certifications

If you need to obtain copies of cross-border transfer-related agreements, please contact us through the method described in Section 17 "Contact Us" of this Policy.

6. Information Security

We take industry-standard security measures to protect your information security, including but not limited to:

• Transmission encryption: site-wide HTTPS encrypted transmission
• Password encryption: user passwords stored using the BCrypt irreversible hash algorithm
• Authentication: JWT-based stateless authentication mechanism
• Access control: role-based access control (RBAC), data-level permission isolation
• Operation auditing: key operations recorded in logs throughout, traceable
• Data isolation: strict multi-tenant data isolation, data between different enterprises is mutually invisible
• Physical and network security: firewalls, intrusion detection systems, DDoS protection, regular security scans
• Access control: least privilege principle, employees require multi-factor authentication for access

Despite the above measures, please understand that the internet is not an absolutely secure environment. In the event of an information security incident, we will notify you and report to regulatory authorities within 72 hours as required by law.

7. Data Ownership and Retention

Your data belongs entirely to you. We only process your data to provide services to you and do not claim ownership of your data.

7.1 Data Retention Period

• During service: while you use the Platform's services, we will continue to retain your personal information and business data to ensure normal service operation
• After account cancellation: after termination of cooperation, we will delete all your personal information and business data within 30 days (unless otherwise required by laws and regulations)
• Log data: operation logs and access logs are retained for 12 months and automatically deleted upon expiration
• Legal requirements: if laws and administrative regulations require a longer retention period (such as anti-money laundering, tax, etc.), we will extend the retention period as required by law

7.2 Data Rights

• Data export: you can export your advertising data, report data, creatives, etc. through platform features at any time
• Data deletion: after termination of cooperation, we will delete all your personal information and business data within 30 days
• Data backup: to prevent data loss, we regularly back up data during the service period, and backup data is deleted together with the primary data

8. Creative Asset Intellectual Property and Usage Rights

Regarding the advertising creatives you upload to the Platform (including but not limited to images, videos, copy, etc.):

• Ownership and copyright: the ownership and copyright of all creatives you upload belong to you (or the original author), and the Platform does not claim any intellectual property rights over the creatives
• Usage authorization: given your need to use the Platform for advertising as an advertiser, you grant the Platform the right to use the creatives in the course of providing advertising services, including but not limited to: displaying, calling, and transferring to TikTok/Google/Meta and other channel APIs, generating placement reports, etc.
• Usage restrictions: the Platform will not use your creatives for any commercial purpose other than advertising services
• Infringement liability: you should ensure that the creatives you upload do not infringe the intellectual property rights of any third party. You shall be solely responsible for any intellectual property disputes arising from creatives you upload

9. Third-Party Data Disclaimer

The following data displayed on the Platform is sourced from third-party platform APIs:

• Advertising spend, ad group status, placement data, etc. are sourced from advertising channels such as TikTok, Google, and Meta
• Order data, inventory data, product data, etc. are sourced from e-commerce platforms such as Shopify

Data Accuracy Disclaimer:

• The authenticity, accuracy, completeness, and timeliness of the above data should be based on the third-party platforms
• You should independently verify key data on the corresponding third-party platforms and should not rely solely on the data displayed on the Platform to make business decisions
• The Platform does not assume any responsibility for the authenticity, accuracy, or completeness of third-party data
• The Platform is not liable for any losses caused by delays, errors, or omissions in third-party data

10. WeChat Notifications and Information Collection

The Platform provides WeChat Official Account message push services to promptly deliver advertising, inventory, and exception alerts:

• Authorization equals consent: by authorizing the WeChat notification feature, you are deemed to consent to the Platform collecting your WeChat account information (including OpenID, nickname, etc.) for message push
• Scope of information use: your WeChat account information is used solely for pushing alert messages to your WeChat and will not be used for other purposes
• Handling of refusal: if you subsequently refuse to authorize the Platform to collect WeChat information, you should proactively notify the Platform through platform settings or by contacting customer service. The Platform will disable the WeChat notification feature and delete the collected WeChat account information
• Notification frequency: you can customize recipients, notification thresholds, do-not-disturb periods, etc. within the platform

11. Sub-Account Management Responsibility

The Platform supports multi-role collaboration. The primary administrator can create sub-accounts for operations, designers, finance, etc.:

• Creation entity: sub-accounts within a customer enterprise are created, authorized, and managed by the customer's primary administrator
• Permission settings: the primary administrator should assign minimum necessary permissions based on sub-account roles and regularly review permission appropriateness
• Risk assumption: risks arising from sub-account operations, permission settings, password management, etc. are borne by the customer (advertiser)
• Account recovery: it is recommended that the customer's primary administrator promptly clean up or adjust sub-account permissions when employees leave or change positions
• Operation traceability: all sub-account operations on the Platform are logged and available for audit by the primary administrator

12. Cookies and Similar Technologies

The Platform uses cookies and similar technologies to enhance your user experience:

• Essential cookies: maintain login state, remember preference settings; some features will not work properly when disabled
• Analytical cookies: analyze user behavior to improve products (if any)

The Platform does not use marketing cookies for cross-site advertising tracking. You can manage or delete cookies through your browser settings.

13. Your Information Rights

Under applicable laws and regulations, you have the following rights regarding your personal information. To exercise these rights, please contact us through the method described in Section 17 "Contact Us" of this Policy.

13.1 Rights of Users in Mainland China (PIPL)

• Right to know and decide: the right to understand the purpose, method, and scope of our processing of your personal information, and to limit or refuse such processing
• Right to access and copy: the right to access and copy your personal information
• Right to data portability: the right to request transfer of your personal information to a personal information handler designated by you
• Right to correction: the right to request correction and supplementation of inaccurate personal information
• Right to deletion: the right to request deletion of your personal information when the processing purpose has been achieved, is no longer necessary, or you withdraw consent
• Right to explanation: the right to request us to explain this Privacy Policy
• Right to withdraw consent: the right to withdraw authorization for channels, stores, WeChat notifications, and other third-party integrations at any time

13.2 Rights of Users in the European Economic Area (GDPR)

• Right of access: obtain a copy of your personal information
• Right to rectification: correct inaccurate personal information
• Right to erasure (right to be forgotten): request deletion of your personal information
• Right to restriction of processing: limit our processing of your personal information
• Right to data portability: obtain and transfer your personal information in a structured, commonly used format
• Right to object: object to our processing of your personal information based on legitimate interests or direct marketing purposes
• Right against automated decision-making: not be subject to decisions based solely on automated processing (including profiling)
• Right to lodge a complaint with a supervisory authority: file a complaint with the local data protection authority regarding the processing of your personal information

13.3 Rights of California Users (CCPA)

If you are a California resident, you have the right to know about our collection and use of your personal information in the past 12 months, including:

• The categories of personal information we have collected
• The sources from which we collected personal information
• The business purposes for collecting, selling, and/or sharing personal information
• The categories of third parties with whom we disclose personal information
• Request deletion of personal information we have collected from you
• Request correction of your personal information
• Request a copy of your personal information
• Request that we not sell or share your data

For the avoidance of doubt, we do not sell or share (as defined by CCPA) your personal information. You may exercise these rights by sending us a written request. As provided by CCPA, you have the right to exercise these rights without discrimination.

13.4 Rights of Users in Other U.S. States

If you are a resident of Virginia (VCDPA), Colorado (CPA), Connecticut (CDPA), Utah (UCPA), or other states, you have the following rights:

• Confirm whether we are processing your personal information and access such information
• Correct inaccuracies in your personal information
• Delete your personal information
• Obtain a copy of the personal information you have provided to us
• Request that we not process your personal information for the following purposes: (i) targeted advertising, (ii) selling your personal information, or (iii) profiling that produces legal or similarly significant effects on you

For the avoidance of doubt, we do not sell your personal information or use your personal information for targeted advertising or profiling. You have the right to exercise these rights without discrimination. If we refuse your exercise of rights, you may send us a written appeal.

13.5 Rights of Brazilian Users (LGPD)

If you are located in Brazil, under LGPD you have the following rights: confirmation of processing, access, correction, anonymization, blocking, deletion, data portability, withdrawal of consent, etc.

13.6 Exercise of Rights

When you withdraw consent, we will no longer process your personal information. However, your decision to withdraw consent does not affect the personal information processing that was previously carried out based on your authorization. To verify your identity, we may ask you to provide necessary identification information. We will respond within 15 business days of receiving your request, and for complex requests, up to 30 days at the latest.

14. Minors

The Platform provides B2B services to enterprise users and does not provide services to minors under the age of 18. If you are a minor, please do not register for or use the Platform's services.

We comply with the Children's Online Privacy Protection Act (COPPA) and any applicable child-related laws. We do not knowingly collect any personal information from children under the age specified by applicable child-related laws.

If a parent or guardian discovers that their child has provided us with personal information without consent, please contact us promptly. We will take reasonable measures to ensure such information is deleted from our records.

15. Marketing and Promotions

We may periodically provide you with information about our products and services and content that may interest you via email, in-platform messages, or WeChat Official Account. Where applicable law requires us to obtain your consent before sending marketing information, we will only send relevant marketing information after obtaining your consent.

If you do not wish to receive such marketing information, you can:

• Unsubscribe through the instructions provided in the marketing message
• Turn off message notifications in the platform's "Account Settings"
• Send an email to support@invx.com requesting not to receive such information

16. Policy Updates

This Policy may be updated due to business adjustments, legal and regulatory changes, or other reasons:

• Material changes: for material changes involving the scope of information collection, purposes of use, sharing partners, user rights, etc., we will notify you through in-platform notifications, email, or SMS
• General changes: non-material changes will be updated directly on this page without separate notice
• Continued use constitutes acceptance: after the Policy is updated, your continued use of the Platform's services constitutes your acceptance of the updated Policy
• Disagreement with updates: if you do not agree with the updated Policy, you may stop using the Platform's services and request data deletion

Previous versions of this Policy will be retained at the bottom of this page for reference.

17. Contact Us

If you have any questions, suggestions, or complaints about this Policy, or need to exercise your personal information rights, you can contact us through the following methods:

• Company name: Shaoguan Liyu Technology Co., Ltd.
• Product name: Invx Cross-Border E-Commerce Advertising Aggregation Platform
• Contact email: support@invx.com
• Privacy-dedicated email: privacy@invx.com
• Company registered address: Shaoguan City, Guangdong Province, China
• Working hours: Monday to Friday 9:00-18:00 (China Standard Time)

We will respond within 5 business days of receiving your feedback. If you are not satisfied with our response, or believe that our processing of your personal information has harmed your legitimate rights and interests, you have the right to file a complaint with the relevant regulatory authority.

— The final right of interpretation of this Policy belongs to Shaoguan Liyu Technology Co., Ltd. —