This policy explains exactly what we collect, where your photos go, and what we refuse to do with them. We have tried to write it so that you can actually read it. Where something might concern you — such as the fact that your images are processed in mainland China — we say so plainly rather than burying it.
Operator & Data Controller
Guangxi Guilin Yaomeng E-commerce Co., Ltd.
广西桂林垚梦电子商务有限公司
Unified Social Credit Code: 91450305MAK31E3170
Legal representative: Liang Yongao
Registered address: Unit 6, Floor 2, Building 16, Plot D-03 (Urban Village Redevelopment / Farmer Resettlement Land), Chuanshan–Tashan Shantytown Redevelopment Project, Qixing District, Guilin, Guangxi 541004, China
Contact: liangleo530@gmail.com
"Sujing AI", "we" and "us" refer to the company above. We are the controller of the personal data described in this policy.
Sujing AI is a photo-retouching tool for hotels, guesthouses and short-term rentals. It improves guest-room photos, building exteriors, public areas and bathrooms — bedding cleanup, lighting and clarity correction, day-to-night conversion, and upscaling. That is the whole product. It does not identify people, analyse faces, or build profiles.
We do not currently offer the Service to individuals located in the European Economic Area, the United Kingdom, or Switzerland.
We have not yet appointed a representative under Article 27 of the GDPR (or its UK equivalent), and we do not direct pricing, language versions, or marketing at those regions. If you are located there, please do not create an account or upload images.
We intend to serve these regions. We will appoint a representative and update this policy before we do, not after.
We welcome users in the United States, Canada, Japan, South Korea, and other regions not listed above.
The list is short because we designed it to be short. We cannot lose what we never collected.
| Category | What exactly | Why |
|---|---|---|
| Account | Your email address; your password stored only as a PBKDF2-HMAC-SHA256 hash (260,000 iterations, unique random salt); your credit balance; the time you registered | To create and secure your account |
| Images | The photo you upload and the tool you selected | To produce the retouched image you asked for |
| Task records | Task id, tool, status, credits charged, timestamps | To show your queue and handle support |
| Purchases | Order id, package, amount, status, and the payment processor's transaction reference | To credit your account and meet accounting law |
| Transient technical | Your IP address, held in memory only | Rate limiting and login-lockout protection |
We never see or store your card number, security code, or bank credentials. Those are handled entirely by the payment processor and never reach our servers.
We use exactly one cookie: sujing_session. It holds a random token and keeps
you logged in. It is set with HttpOnly (JavaScript cannot read it),
Secure (sent only over HTTPS) and SameSite=Lax (not sent
from other sites). The server stores only a SHA-256 hash of the token, not the token itself.
There are no advertising or analytics cookies. Deleting this cookie simply logs you out.
Your photos are processed in mainland China.
Our servers are located in the Guangxi Zhuang Autonomous Region, People's Republic of China. Your uploaded image is sent over an encrypted HTTPS connection to Alibaba Cloud Model Studio (DashScope), also in mainland China, which runs the AI model that produces your result.
China has not received an adequacy decision from the European Commission, and its legal framework differs from those of the United States, Canada, Japan and South Korea. Under Chinese law, companies can in defined circumstances be required to provide data to state authorities.
We tell you this before you upload anything, not in a footnote afterwards.
| Item | Detail |
|---|---|
| Recipient | Alibaba Cloud — Model Studio / DashScope image-generation API |
| Country of recipient | People's Republic of China (mainland) |
| Data transferred | The image file you upload, plus the processing instruction for the tool you selected |
| Purpose | To generate the retouched image you requested |
| Method | Encrypted HTTPS API request |
| Retention | Deleted within 24 hours — see Section 8 |
| Not transferred | Your email address and password are never sent to the AI provider. They stay on our own server. |
Before your first upload we show you a notice covering the points above and ask you to accept it. This is enforced on our server, not merely in the browser: uploads are refused until your consent has been recorded, together with the date and the version of the notice you agreed to.
You can withdraw consent at any time by emailing us from your registered address. Withdrawal is as easy as giving consent. It stops future uploads from being processed; it does not undo processing that already took place lawfully.
| Data | Retention |
|---|---|
| Images you upload | Deleted no later than 24 hours after the task is created |
| Generated results | Same — deleted with the original |
| Task records (including image paths) | Deleted together with the images |
| Account (email, password hash, credit balance) | Until you ask us to delete it |
| Credit ledger (who, when, which tool, how many credits) | Retained long term. It contains no images and nothing from your images — it is bookkeeping only, used for reconciliation, disputes, and payment-provider review |
| Purchase records | Retained as required by PRC accounting and tax law |
A cleanup job runs every 30 minutes. It permanently removes the original file, the result file, and the database record. This is automatic and not something we perform by hand.
Please download your results within 24 hours. After deletion we cannot recover them for you — not because we refuse, but because they no longer exist.
The one exception to all of the above: a valid, legally binding order from a competent authority. If we ever receive one and are legally permitted to tell you, we will.
An honest limitation. No system is perfectly secure, and we are a small company, not a large one with a dedicated security team. Our strongest protection is that we deliberately hold very little: an email address, a password hash, and images that delete themselves within 24 hours.
If a breach ever affects your data, we will email you without undue delay and tell you what happened, what was affected, and what we are doing about it.
Whatever your country, you may ask us to:
Email liangleo530@gmail.com from your registered address. We reply within 30 days, and there is no charge.
Categories of personal information collected in the last 12 months: identifiers (email address), commercial information (purchase records), user content (uploaded images), and transient internet activity (IP address, held in memory only). Sources: you. Business purpose: to provide the Service.
We do not sell or share personal information as those terms are defined by the CCPA, and we have never done so. There is therefore no "Do Not Sell or Share My Personal Information" mechanism to offer you — there is nothing to opt out of.
You have the right to know, delete, and correct, and the right not to be discriminated against for exercising those rights.
Under the Act on the Protection of Personal Information, we inform you that your personal data (your uploaded image) is provided to a third party located in a foreign country — the People's Republic of China. Section 7 gives the recipient, the country, the items transferred, and the purpose. We obtain your consent before the transfer takes place.
The table in Section 7 constitutes the disclosure required by the Personal Information Protection Act before personal data is transferred overseas: the recipient, its country, the items transferred, the purpose, the method, and the retention period. Your consent is obtained before any transfer. You may refuse — in that case we cannot provide the Service, since processing your image is the Service.
Your personal information may be processed outside Canada and is therefore subject to the laws of the People's Republic of China, including lawful access by authorities of that country.
The Service is intended for businesses and for adults aged 18 or over. We do not knowingly collect personal data from children. If you believe a child has given us data, email us and we will delete it.
If we change this policy we will post the new version here with a new effective date. If we materially change how images are processed or transferred across borders, we will ask for your consent again rather than relying on the consent you gave to an earlier version.
Email liangleo530@gmail.com. Please write in English, Chinese or Japanese. Postal mail may be sent to the registered address in Section 1, but email reaches us faster.
