1 Who we are and what this notice covers
悦宠家（成都）科技有限公司 (the Company, we, us) develops and operates StarAxis, including StarAxis Finance. This notice covers personal information handled for these business services and related business or privacy enquiries. It does not replace the privacy notices of TikTok Shop, Amazon or other merchants' own services.
StarAxis Finance supports authorized financial data collection, aggregation and reconciliation. The TikTok Shop connection is under development: its authorization callback and live data collection have not yet been implemented. The planned scope is retrieval of statements, statement transactions, payments and unsettled transactions for merchants that separately authorize the application. The service does not initiate payments or transfer funds. This notice does not claim that TikTok Shop or another platform has approved the integration.
For privacy questions or requests, contact our Privacy Owner at security@cheerpals.com.
2 Information involved
Depending on the service and your relationship with us, information may include:
- Business user and contact information, such as name, work email, organization, user identifier, role and correspondence needed to administer access or answer an enquiry.
- Merchant and shop information, such as business or shop identifiers, authorized connections and access scopes.
- Financial records supplied or made available under appropriate authority, such as statement or transaction identifiers, dates, amounts, currencies, fees, refunds and reconciliation results. Financial records are assessed for personal information where relevant.
- Operational and security records, such as sign-in activity, permission changes, request timestamps, technical identifiers and errors needed to operate and protect the service.
- Privacy or support request information needed to verify authority, investigate the request and record its outcome.
For the planned TikTok Shop connection, platform authorization records and credentials would be handled only for the permitted connection and protected as restricted information. We do not ask merchants to send us their platform passwords. Buyer identity or shipping information is not requested merely to perform financial reconciliation. Any proposed expansion of personal-data fields or use requires a separate assessment and the required authority before activation.
Information comes from business users, authorized merchant instructions or records, the permitted platform connection when enabled, and the service's operation. An authorization from one merchant does not authorize access to another merchant's records.
3 How and why information is used
We use information for the disclosed business purpose and within appropriate authority: to administer accounts and permissions; provide the authorized collection and reconciliation service; respond to support or privacy requests; maintain security and investigate misuse; and meet applicable legal obligations.
When we process merchant-controlled information on a merchant's instructions, we follow the permitted purpose and applicable service arrangements. We are responsible for our own account administration, security and business correspondence where applicable. The relevant legal role and basis depend on the processing activity and applicable law. Consent or another lawful basis must be obtained where required; a platform authorization does not waive data protection or platform restrictions.
Platform information must not be sold or used for unrelated advertising, cross-merchant profiling or unauthorized disclosure. We do not use reconciliation data to initiate payments. New purposes, recipients or fields require review and any further notice or authorization required by law and the relevant platform.
4 Access and recipients
Information is available only to authorized personnel and service providers who need it for the permitted purpose. We use cloud infrastructure and database services; the currently identified database service is Alibaba Cloud RDS for PostgreSQL, with RDS automatic backups. Service providers must be assessed and bound by applicable confidentiality, security and processing obligations before access.
Information may also be provided to an authorized merchant, a person with verified authority, or a public authority where disclosure is legally required. Each disclosure must be limited to the relevant purpose and scope. We do not disclose one merchant's records to another merely because both use StarAxis. A new provider, recipient or material processing change requires assessment before access is enabled.
5 Processing locations
Our current StarAxis processing locations, including storage, backups, logs, authorized remote personnel and entrusted providers, are in mainland China. Before changing a location or allowing access from another country or region, we must assess applicable legal and platform requirements and complete the required notices, approvals and safeguards. A merchant's target sales market does not by itself describe the location of our processing.
6 Retention and deletion
Information must be kept only for the time necessary for its authorized purpose and applicable platform, contractual and legal requirements. The relevant criteria include the service relationship, continuing authority, reconciliation needs, a valid deletion request and any specific legal retention duty. A legally required archive must be limited, protected and restricted to that purpose.
When a merchant withdraws authority or the relevant relationship ends, affected collection and unauthorized use must stop. The applicable retention and deletion schedule must cover source records, derived data, exports, caches and backups, including copies held by service providers. A restoration must not make deleted information or revoked authority available again.
The TikTok Shop connection and its complete lifecycle deletion workflow are not yet in operation. Before enabling the connection, we must validate the applicable retention and deletion deadlines and the handling of all relevant copies. This notice does not state that a complete automated TikTok deletion workflow already exists. Applicable platform limits and legal obligations govern any permitted retention exception.
7 Security
We restrict access according to authorized business need and use safeguards appropriate to the information and service. These include access controls, multifactor authentication for relevant personnel accounts, encryption, managed endpoint protection and security monitoring. Security measures are reviewed as the service develops. No service can guarantee that all security risks will be eliminated.
Authentication and related security technologies support sign-in, sessions and protection against misuse. Any optional tracking must be assessed and disclosed, with choices provided where applicable law requires them. This notice does not authorize unrelated advertising or tracking use of platform information.
8 Your requests and choices
Subject to applicable law and the Company's role, you may request access to or a copy of your personal information, correction, deletion, restriction or other available rights. You may withdraw consent where consent is the applicable basis, and merchants may withdraw the relevant platform authorization. Withdrawal does not itself change lawful obligations that require limited retention.
Send requests to security@cheerpals.com with the request type and enough business context to identify the relevant relationship. Do not send passwords, tokens or unnecessary identity documents. We verify identity and authority proportionately and respond within the applicable deadline. If the information is controlled by a merchant, we may direct the request to that merchant and assist it as required. We will explain any lawful limitation or additional verification that is necessary. You may also contact the competent authority where the applicable law provides that right.
9 Business users and children
StarAxis is intended for companies and authorized business users. It is not designed as a service for children. If you believe a child's personal information has been provided without appropriate authority, contact us so that the Privacy Owner can assess and address it.
10 Updates and contact
Material changes to purposes, recipients or processing locations require review and any notice or authorization required by applicable law and platform terms. The published notice will identify its effective date and subsequent updates.
Company: 悦宠家（成都）科技有限公司
Privacy contact: Privacy Owner, security@cheerpals.com