Privacy policy

This website and HangRui's products are provided by 航睿智能有限公司, which is answerable for them. The full company name, company number, registered address and telephone number are in the last chapter of this page and in the footer, and the two agree.

For the data described here, 航睿智能有限公司 is the non-government agency under the Personal Data Protection Act, and the party that collects, processes and uses it. Requests about your data go to the privacy address in the last chapter; a person handles that mailbox, not a queue.

To create and maintain your account and provide the service you asked for. The basis is the contract, or the relationship akin to a contract, between you and us.

To take payment, issue the statutory invoice, and keep the books. The basis is that contract, and obligations the law places on us.

To answer you and handle disputes, which is also why you wrote.

To keep the service secure, prevent abuse, and detect and fix faults.

To comply with the law, or with a lawful request from a court or an authority.

Where a product has a newsletter or marketing, the basis is your consent. That one stands apart from the five above: withhold it and the five are unaffected. A first marketing message carries a free way to refuse, and we stop as soon as you do.

Nothing beyond the above. Your prompts, uploads and generated output are not used to train our models, and are not handed to anyone else to train theirs — this is not a setting you have to go and find. We do not sell personal data, we do not buy it from brokers, and we do not build cross-site advertising profiles.

If we ever want to show a piece of work as an example, we ask you first, and saying no costs you nothing.

Identity and contact: your email address, and the name and company you choose to give.

Account: the hash of your password — we do not keep the password itself — and sign-in times.

Transactions: order number, item, amount, time, invoice number.

Payment: we never touch or store your full card number. It goes to the payment processor named in chapter four, and we receive only the authorisation result and identifiers such as the last four digits.

What you put into the service: the material and text you upload or type, and the output produced from it. We treat this as your content, not ours.

Technical records: IP address, browser and device type, pages visited, error reports.

Except where the last chapter of this page says otherwise, we do not collect the special categories in article 6 — medical records, healthcare, genetics, sex life, health examinations and criminal records.

Means: processed electronically, for the purposes in chapter two and no others.

Period: your account and what you put into the service are kept while the account lasts; after it closes, content can still be exported for 30 days and is then deleted. Transaction and invoice records are kept for the period tax law requires — that category we cannot delete early, because the law obliges us to hold it. Messages you send us are kept for two years. Technical records are kept for 90 days.

Territory: Taiwan, and wherever our service providers actually process data, which today is Japan, Singapore and the United States. We transfer internationally under article 21; if an authority restricts a particular country, we stop transferring there.

Recipients: the payment processor that handles cards and collection, currently 綠界科技股份有限公司 (ECPay); the electronic invoicing service that issues and files invoices as the law requires, currently 光貿科技股份有限公司 (Amego); the hosting, database, content delivery and error monitoring providers, each under contract to process data only on our instructions and never for their own purposes; the model provider that runs generation — which one this site uses today is in the last chapter; and courts, prosecutors or other authorities, only within a lawful request, and unless the law forbids it we tell you.

Nobody else. The current list of providers, and where each one processes data, can be had from the privacy address in the last chapter.

You may ask to review or inspect the personal data we hold about you, ask for a copy, ask for it to be supplemented or corrected, ask us to stop collecting, processing or using it, and ask us to delete it. Where we rely on your consent, you may withdraw it at any time; withdrawal does not affect processing already carried out, and does not affect the five purposes in chapter two.

How: write to the privacy address in the last chapter and say which one you want. The statutory deadlines come in two lengths — for review, inspection and copies we decide within 15 days, extendable once by no more than 15 days with written reasons; for correction, stopping and deletion we decide within 30 days, extendable once by no more than 30 days.

No charge. Where the law allows us to recover the necessary cost of a search or a copy, we tell you the amount first and you decide.

Two things to say up front: data we are obliged to retain, such as transaction and invoice records, cannot be deleted within that period; and stopping the processing of data an account needs in order to exist is the same as ending the service, so we will say so and leave the decision to terminate with you.

Nothing in this policy limits any of these rights — article 3 says in terms that they cannot be waived in advance or restricted by agreement. If our answer does not satisfy you, you may complain to the competent authority or to your city or county government, and you may go to court.

You do not have to give us anything. Without an email address there is no account, and so no features that need one; without payment details a payment cannot complete, and so no paid item; without the content you want handled there is nothing for the service to work on; and blocking technical records with a tool may stop pages rendering properly or stop us preventing abuse.

This website's own part is in the last chapter.

We use three kinds and no others: one that keeps you signed in, which is necessary and which clearing will sign you out; ones that remember a preference such as language or light and dark theme, which stay on your device; and traffic and error analytics, so we know which pages are read and which features break.

We set no advertising cookies, do no cross-site tracking, and build no advertising profiles.

You can block or delete cookies in your browser. Blocking the first kind means you cannot sign in.

The whole site is served over an encrypted connection; personal data is never transmitted unencrypted.

Access is restricted by row-level permission rules; the higher-privilege key is used only on the server and never reaches a browser.

Credentials and keys live in environment variables and are not written into the code repository.

Passwords are stored only as hashes, never in the clear.

Data is backed up regularly, and a deletion request covers the backups, within the period stated in this policy.

If personal data is stolen, altered, damaged, lost or disclosed, we email the people affected once we know what happened, and notify the authority as the law requires.

A person under 18 may register and use the service only after a legal representative has read, understood and agreed to this policy and the terms. A person under 7 may not use it.

If we learn that data reached us from a minor without a legal representative's agreement, we delete it. If you believe that has happened, write to the privacy address in the last chapter.

When this policy changes, the version date at the top changes with it, and the full text stays published on this page.

For a material change to your rights — the purposes, the categories, the recipients, the retention periods, or how you exercise your rights — we email account holders 30 days before it takes effect and post it here; you may terminate before it does, and anything paid for and not delivered is refunded pro rata.

We do not substitute “continued use means you agree” for that notice, and we do not quietly edit the page.

Requests about your data, or questions about this policy, go to the privacy address below; general support goes to the support address.

The lines in the footer and this chapter are the same record, from the same file, and it is published at /.well-known/company.json. If the two ever disagree, the Ministry of Economic Affairs company register governs — and please write and tell us at once.

This website sells nothing and has no accounts, so the account and payment categories in chapter three are empty here. Three things are collected: what you type into the contact form — name, email, company, which service you want to talk about, and your message; what you type into the assistant panel or the lyrics demo, which creates no account and is not tied to your identity; and traffic and error records.

Not using the contact form means you cannot reach us that way — the address in the footer still works. Not using the assistant or the demos leaves the rest of the site entirely unaffected.

This site sets two cookies and neither identifies you: one remembers whether you chose Chinese or English, and one remembers light or dark, which stays in your browser and is never sent back. There is no sign-in here, so there is no session cookie.

The assistant panel and the lyrics demo are demonstrations, not a service commitment: they may change or be switched off at any time; answers carry citations, but a citation only shows that the sentence has a source on this site, not that the answer is complete; and what a demo produces is not kept — close the page and it is gone.

Text generation on this site currently runs on a machine of our own, in Taiwan. The assistant and the lyrics demo are both answered there, and what you type and what it writes back stay on that machine; only when it does not respond does a request fall through to the supplier below.

MiniMax, a company in Shanghai, China. What you type into the demos on this site is sent there and the generated text comes back. Your name, email address and account do not go with it — but it does leave Taiwan.