Dear End User:
Please be advised that the owner of the software, app, or website that you are registering for, logging in to, or using (collectively, the “Platform”; its owner, the “Platform Operator”) has engaged Beijing Yishu Technology Co., Ltd. (“we,” “us,” or the “Company”) to provide data analytics-related services (the “GIO Services”), and the GIO Services may use some or all of the information you provide to the Platform or the Platform Operator. The Company may also need to collect some or all of the data generated when you use the Platform or its services in order to provide the GIO Services to the Platform or the Platform Operator.
The Company understands the importance of your information and will make every effort to protect its security and reliability. We will provide adequate safeguards for your personal information in accordance with applicable laws and regulations and with reference to industry best practices.
As we do not have a direct contractual relationship with you, we have required the Platform Operator to inform you, through appropriate means such as the Platform’s privacy policy or service agreement, that it has integrated the functional modules of, or is using, the GIO Services. We also require the Platform Operator to ensure that you understand and agree that its rights to obtain and use your relevant information extend to the Company, so that the Company may obtain and use the reasonable information necessary to provide the GIO Services.
Nevertheless, through this privacy policy, we also wish to help you understand how we collect, use, share, transfer, publicly disclose, and protect your information while providing the GIO Services. We also disclose the purposes, methods, and scope of our collection and use of information, and provide methods for accessing, updating, and deleting your information. To protect your lawful rights and interests, please read and fully understand these Terms carefully, especially the provisions shown in bold. By downloading, installing, logging in to, or using the Platform, you are deemed to have agreed to all of these Terms. If you do not agree with these Terms, please contact the Platform or the Platform Operator promptly and take further action in accordance with its instructions.
1. Collection of Personal Information
1.1 The Company will collect and use your information only as necessary and for the purpose of providing the GIO Services commissioned by the Platform Operator, provided that the Platform Operator has obtained your full authorization and the Platform or the Platform Operator has opened the necessary interfaces to the Company. Within the scope necessary for the GIO Services, we use tools such as software development kits (SDKs) to collect and use your information. Depending on the SDK type and application scenario, the specific information that may be collected is as follows:
|
SDK Type |
Type of Personal Information Collected |
Purpose |
Optional |
|
Android SDK |
Page Path |
Required for data analytics |
Collected by default |
|
Page Referrer |
Required for data analytics |
Collected by default |
|
|
Page Title |
Required for data analytics |
Collected by default |
|
|
IMEI |
Used for data analytics; the SDK generates a unique device ID based on device identifiers |
Optional; controlled through initialization settings and not collected by default |
|
|
androidld |
Used for data analytics; the SDK generates a unique device ID based on device identifiers |
Optional; controlled through initialization settings and not collected by default |
|
|
gaid |
Used for data analytics; the SDK generates a unique device ID based on device identifiers |
Optional; controlled through initialization settings and not collected by default |
|
|
oaid |
Used for data analytics; the SDK generates a unique device ID based on device identifiers |
Optional; controlled through initialization settings and not collected by default |
|
|
deviceId |
Used for data analytics; a unique device ID generated by the SDK |
Collected by default; generation priority is androidId > IMEI > UUID. If collection of androidId and IMEI is not permitted, a random UUID is used |
|
|
Device Orientation |
Required for data analytics |
Collected by default |
|
|
Screen Height |
Required for data analytics |
Optional; this field can be filtered through initialization settings and is collected by default |
|
|
Device Brand and Model |
Required for data analytics to distinguish device brands and models |
Optional; this field can be filtered through initialization settings and is collected by default |
|
|
Operating System |
Required for data analytics to distinguish device operating systems |
Collected by default |
|
|
Operating System Version |
Required for data analytics to distinguish device operating system versions |
Collected by default |
|
|
Language and Locale |
Required for data analytics to distinguish device language settings and locales |
Optional; this field can be filtered through initialization settings and is collected by default |
|
|
Clipboard — deep-link information set by GIO |
To provide advertising deep-link services |
Optional; controlled through initialization settings and not collected by default |
|
|
Time Zone |
Required for data analytics to distinguish the time zones in which events occur |
Optional; this field can be filtered through initialization settings and is collected by default |
|
|
Network Type |
Required for data analytics |
Optional; this field can be filtered through initialization settings and is collected by default |
|
|
Latitude and Longitude |
Required for data analytics |
Optional; based on business analytics needs, the website, app, or mini program may collect location information after obtaining the user’s authorization. The SDK does not actively collect it |
|
|
iOS SDK |
Page |
Required for data analytics |
Collected by default |
|
Page Referrer |
Required for data analytics |
Collected by default |
|
|
idfa |
Used for data analytics; the SDK generates a unique device ID based on device identifiers |
Collected by default; the relevant permission must be requested before initialization, and the information is not collected without that permission |
|
|
idfv |
Used for data analytics; the SDK generates a unique device ID based on device identifiers |
Collected by default |
|
|
deviceId |
Used for data analytics; a unique device ID generated by the SDK |
Collected by default; generation priority is IDFA > IDFV > UUID. If collection of IDFA and IDFV is not permitted, a random UUID is used |
|
|
Device Orientation |
Required for data analytics |
Collected by default |
|
|
Screen Height |
Required for data analytics |
Optional; this field can be filtered through initialization settings and is collected by default |
|
|
Device Brand and Model |
Required for data analytics to distinguish device brands and models |
Optional; this field can be filtered through initialization settings and is collected by default |
|
|
Operating System |
Required for data analytics to distinguish device operating systems |
Collected by default |
|
|
Operating System Version |
Required for data analytics to distinguish device operating system versions |
Collected by default |
|
|
Language and Locale |
Required for data analytics to distinguish device language settings and locales |
Collected by default |
|
|
Clipboard — deep-link information set by GIO |
To provide advertising deep-link services |
Optional; controlled through initialization settings and not collected by default |
|
|
Time Zone |
Required for data analytics to distinguish the time zones in which events occur |
Collected by default |
|
|
Network Type |
Required for data analytics |
Optional; this field can be filtered through initialization settings and is collected by default |
|
|
Latitude and Longitude |
Required for data analytics |
Optional; based on business analytics needs, the website, app, or mini program may collect location information after obtaining the user’s authorization. The SDK does not actively collect it |
|
|
Web SDK |
deviceId |
Used for data analytics; a unique device ID generated by the SDK |
Collected by default; generated as a random UUID |
|
Page Path |
Required for data analytics |
Collected by default |
|
|
Page Referrer |
Required for data analytics |
Collected by default |
|
|
Page Title |
Required for data analytics |
Collected by default |
|
|
Page Parameters |
Required for data analytics |
Collected by default |
|
|
Screen Height |
Required for data analytics |
Optional; this field can be filtered through initialization settings and is collected by default |
|
|
Language and Locale |
Required for data analytics to distinguish device language settings and locales |
Collected by default |
|
|
Device Type |
Required for data analytics to distinguish device types |
Collected by default |
|
|
Time Zone |
Required for data analytics to distinguish the time zones in which events occur |
Collected by default |
|
|
Latitude and Longitude |
Required for data analytics |
Optional; based on business analytics needs, the website, app, or mini program may collect location information after obtaining the user’s authorization. The SDK does not actively collect it |
|
|
Mini Program SDK |
deviceId |
Used for data analytics; a unique device ID generated by the SDK |
Collected by default; generation priority is the user-defined ID > random UUID. If the user does not define an ID, a random UUID is used |
|
Network Type |
Required for data analytics |
Optional; this field can be filtered through initialization settings and is collected by default |
|
|
Page Path |
Required for data analytics |
Collected by default |
|
|
Page Referrer |
Required for data analytics |
Collected by default |
|
|
Page Parameters |
Required for data analytics |
Collected by default |
|
|
Device Type |
Required for data analytics to distinguish device types |
Optional; this field can be filtered through initialization settings and is collected by default |
|
|
Screen Height |
Required for data analytics |
Optional; this field can be filtered through initialization settings and is collected by default |
|
|
Device Brand and Model |
Required for data analytics to distinguish device brands and models |
Optional; this field can be filtered through initialization settings and is collected by default |
|
|
Operating System |
Required for data analytics to distinguish device operating systems |
Optional; this field can be filtered through initialization settings and is collected by default |
|
|
Operating System Version |
Required for data analytics to distinguish device operating system versions |
Collected by default |
|
|
Language and Locale |
Required for data analytics to distinguish device language settings and locales |
Collected by default |
|
|
Mini Program Scene Value |
Required for data analytics |
Collected by default |
|
|
Time Zone |
Required for data analytics to distinguish the time zones in which events occur |
Collected by default |
|
|
Latitude and Longitude |
Required for data analytics |
Optional; based on business analytics needs, the website, app, or mini program may collect location information after obtaining the user’s authorization. The SDK does not actively collect it |
|
|
HarmonyOS SDK |
deviceId |
Used for data analytics; the SDK generates a unique device ID based on device identifiers |
Collected by default; generated as a random UUID |
|
Page Path |
Required for data analytics |
Collected by default |
|
|
Page Referrer |
Required for data analytics |
Collected by default |
|
|
Page Title |
Required for data analytics |
Collected by default |
|
|
UUID |
Used for data analytics; the SDK generates a unique device ID based on device identifiers |
Collected by default |
|
|
Device Orientation |
Required for data analytics |
Collected by default |
|
|
Screen Height |
Required for data analytics |
Collected by default |
|
|
Device Brand and Model |
Required for data analytics to distinguish device brands and models |
Collected by default |
|
|
Operating System |
Required for data analytics to distinguish device operating systems |
Collected by default |
|
|
Operating System Version |
Required for data analytics to distinguish device operating system versions |
Collected by default |
|
|
Language and Locale |
Required for data analytics to distinguish device language settings and locales |
Collected by default |
|
|
Time Zone |
Required for data analytics to distinguish the time zones in which events occur |
Collected by default |
|
|
Network Type |
Required for data analytics |
Collected by default |
|
|
Latitude and Longitude |
Required for data analytics |
Optional; based on business analytics needs, the website, app, or mini program may collect location information after obtaining the user’s authorization. The SDK does not actively collect it |
1.2 For lawful and compliant purposes such as data analytics, the Platform Operator may use the Company’s SDK to request the following permissions from you.
(1) Android Device Permissions
|
Permission |
Purpose |
Required |
Permission Request Timing |
|
android.permission.INTERNET |
Allows the application to access the network and send statistical data in order to provide analytics services. Required permission |
Required permission |
Requested when data analytics is performed, for example when reporting relevant data |
|
android.permission.ACCESS_NETWORK_STATE |
Detects the network connection type and prevents data transmission when the network is abnormal, saving data usage and battery power. Required permission |
Required permission |
Requested when data analytics is performed, for example when reporting relevant data under different network conditions |
|
android.permission.ACCESS_WIFI_STATE |
Obtains the Wi-Fi network type and detects the connection method, saving data usage and battery power. Required permission |
Required permission |
Requested when data analytics is performed, for example when reporting relevant data under different network conditions |
|
android.permission.READ_PHONE_STATE |
Obtains the IMEI of the user’s device and uses it to uniquely identify the user in order to provide analytics services. (Available only below Android 10; it can no longer be obtained on Android 10 or later.) Optional permission |
Optional permission |
Requested when data analytics is performed, such as when a unique identifier must be generated for the device or advertising attribution is required. If collection is needed, the relevant feature must also be enabled in the configuration before SDK initialization (all such features are disabled by default) |
(2) iOS Device Permissions
|
Permission |
Purpose |
Required |
Permission Request Timing |
|
Network |
Allows the application to access the network and send data in order to provide analytics services. Required permission |
Required permission |
Requested when data analytics is performed, for example when reporting relevant data under different network conditions |
|
IDFA |
Allows the application to obtain the IDFA in order to identify anonymous users. Optional permission |
Optional permission |
Requested when data analytics is performed, such as when a unique identifier must be generated for the device or advertising attribution is required. If collection is needed, the relevant permission must be obtained before SDK initialization (no collection occurs by default without permission). IDFA can be disabled through the relevant configuration (for example, for children’s applications) |
(3) HarmonyOS Device Permissions
|
Permission |
Purpose |
Required |
Request Timing |
|
ohos.permission.INTERNET |
Allows the application to access the network and send statistical data in order to provide analytics services. |
Required permission |
When sending event tracking data |
|
ohos.permission.GET_NETWORK_INFO |
Obtains the current network connection type in order to provide analytics services. |
Required permission |
When sending event tracking data |
1.3 Please note that we have required the Platform Operator to ensure that you have confirmed and authorized us, during the provision of the GIO Services and in compliance with applicable laws and regulations, to collect, use, and process information for the purpose of providing the GIO Services.
1.4 Please understand that, under applicable laws, regulations, and national standards, we may collect your relevant personal information without obtaining your consent in the following circumstances:
(1) Where it is directly related to national interests such as national security or national defense security;
(2) Where it is directly related to significant public interests such as public security, public health, or the public’s right to know;
(3) Where it is directly related to criminal investigation, prosecution, trial, or enforcement of judgments;
(4) Where it is necessary to protect significant lawful rights and interests, including your or another individual’s life, property, and reputation, but it is difficult to obtain the individual’s consent;
(5) Where the personal information collected has been voluntarily disclosed by you to the public;
(6) Where personal information is collected from lawfully publicly disclosed information, such as lawful news reports or government information disclosures;
(7) Where it is necessary for entering into or performing a contract at your request;
(8) Where it is necessary to maintain the safe and stable operation of the products or services provided, such as identifying or handling product or service failures;
(9) Where it is necessary for lawful news reporting;
(10) Where it is necessary for statistical or academic research carried out in the public interest, and the personal information contained in the externally provided research or descriptive results is de-identified;
(11) Other circumstances stipulated by laws and regulations.
1.5 Where the collection of information needed to provide the GIO Services exceeds the scope above, we will require the Platform Operator to notify you and obtain your authorization and consent before obtaining the information.
2. Storage of Personal Information
2.1 Methods and Duration of Information Storage
2.1.1 We will store your information securely, including through local storage (for example, data caching through an app), databases, and server logs.
2.1.2 We will store your personal information only for the time necessary to achieve the purpose of the GIO Services or as required by laws and regulations. Unless applicable law or the Platform Operator requires a longer retention period, the Company will delete your information within a reasonable period after the purpose of the GIO Services has been achieved (generally no more than 60 calendar days).
2.1.3 Notwithstanding the foregoing, the Company may still back up necessary information for the following purposes, and the retention period for such backups may exceed the period specified in Section 2.1.2: (1) resolving disputes; (2) maintaining the secure and complete operation of the Company’s services; and (3) disaster prevention. The Company hereby undertakes that such backup information must not and cannot be used in a production environment, and may only be used for the purposes specified above.
2.2 Location of Information Storage
2.2.1 We will store personal information collected within China in China in accordance with laws and regulations.
2.2.2 We currently do not transmit or store your personal information across borders, unless we have obtained your explicit authorization (and doing so does not violate laws or regulations) or applicable laws and regulations expressly require it. If cross-border transmission or storage is necessary, we will inform you in advance of the purpose of the outbound transfer, the recipient, security measures, and security risks.
3. Use, Sharing, Transfer, and Disclosure of Personal Information
3.1 We will not provide, transfer, share, or disclose your information to any unrelated third party, except in the following circumstances:
(1) Where we have obtained your explicit consent;
(2) Where required by laws or regulations, or by mandatory requirements of competent government authorities;
(3) Where we provide, transfer, share, or disclose your information to our affiliates, but only as necessary for the GIO Services described in these Terms;
(4) Where we provide, transfer, share, or disclose your information to our authorized partners, but only as necessary for the GIO Services described in these Terms, and the partner has signed a confidentiality agreement with us, or the cooperation agreement already signed includes clear confidentiality provisions under which the partner undertakes confidentiality obligations for your information;
(5) Where, in connection with a merger, acquisition, or bankruptcy liquidation, we may provide, share, or disclose your information to our investors or transfer it to our successors. In that event, we will further require our investors or successors to comply with these Terms or assume confidentiality obligations no less stringent than those set out in these Terms.
3.2 In most cases, we will de-identify or anonymize the personal information collected in accordance with law. Such information is non-user information that cannot be used to re-identify the individual concerned and no longer falls within the scope of personal information under applicable laws.
If we combine non-personal information with other information to identify you personally, or use it together with your personal information, we will treat and protect such information as your personal information under this privacy policy during the period of combined use.
3.3 Where the use of information needed to provide the GIO Services exceeds the scope above, where collected information is to be used for purposes not specified in these Terms, or where information collected for a specific purpose is to be used for another purpose, we will require the Platform Operator to notify you and obtain your authorization and consent before using the information.
3.4 Please understand that, under applicable laws, regulations, and national standards, we may use, share, transfer, or publicly disclose your information without obtaining your authorization and consent for the matters listed in Section 1.3 of these Terms.
4. Protection of Personal Information
4.1 We strive to protect the security of users’ information and to prevent information leakage, loss, improper use, unauthorized access, and disclosure. We use comprehensive security measures to ensure that users’ personal information is protected at a reasonable security level, including technical protection measures, management controls, and security system safeguards.
4.2 We have obtained the following certifications: Level 3 Certification of the Multi-Level Protection Scheme for Information System Security, Quality Management System Certification (ISO 9001), Information Security Management System Certification (ISO 27001), and Privacy Information Management System Certification (ISO 27701).
4.3 We use industry-leading technical protection measures. These security measures include, without limitation, password encryption, de-identification or anonymization, and access controls.
4.4 We have established dedicated management systems, processes, and organizations to safeguard personal information security. We also review them from time to time to prevent unauthorized personnel from accessing, using, or disclosing users’ information without authorization.
4.5 Although we have taken these security measures, please note that no security measures on the Internet are perfect. Your information may still be illegally accessed, stolen, tampered with, or destroyed, causing damage to your lawful rights and interests. This includes, without limitation, situations in which other software you download and install or other websites you access contain viruses, Trojan programs, or other malicious programs that threaten the security of your device information and data. The Company assumes no liability in this regard. Please understand and voluntarily assume the foregoing risks.
4.6 If a security incident such as the leakage, damage, or loss of personal information occurs, we will activate an emergency response plan to prevent the incident from expanding. After the incident occurs, we will promptly notify you by push notification, email, or other means of the basic circumstances of the incident, the measures we will take or have taken to address and remedy it, and our recommendations for your response. If it is difficult to notify each person individually, we will issue a warning through announcements or other means.
5. Protection of Minors
5.1 We attach great importance to the protection of minors’ personal information. In accordance with applicable laws and regulations, we require the Platform Operator, before collecting and providing us with the personal information of a minor under 14 years of age, to obtain the prior authorization and consent of the minor’s guardian (such as a parent). For minors who are at least 14 but under 18 years of age, the Platform Operator must obtain prior authorization and consent from the minor’s guardian or from the minor.
5.2 We use, provide externally, or publicly disclose minors’ information only where permitted by laws and regulations, with the explicit consent of the minor’s guardian, or where necessary to protect the minor.
6. Your Rights
As you are not our direct customer, please send your relevant requests directly to the Platform or the Platform Operator in accordance with the Platform Operator’s privacy policy, and the Platform or the Platform Operator will relay your requests to us. We will require the Platform or the Platform Operator to undertake to provide you with an easy-to-use mechanism for exercising user rights, including explaining how to exercise your choices; how to access, correct, or supplement your information; how to exercise your right to delete; and how to change the scope of your authorization and consent.
7. Updates
Our privacy policy may change. The Company will adjust and republish these Terms as appropriate based on its actual operations and performance, and the requirements of laws and regulations. We will provide the updated privacy policy to the Platform Operator and require it to update and publish it on the Platform in a timely manner. If you choose to continue using the Platform or its services, you will be deemed to have accepted the adjustments or changes to the relevant provisions of this policy. If you do not agree with these Terms, please contact the Platform or the Platform Operator promptly and take further action in accordance with its instructions.
Without your explicit consent, we will not reduce the rights you are entitled to under these Terms.
8. Contact
If you have any questions, comments, or suggestions regarding this privacy policy, please contact us using the details below. We will review the matter as soon as possible and respond within 15 days:
(1) Send an email to legal@startdt.com;
(2) You may also mail your questions to: Building 15, Internet Village, Dream Town, No. 1399 Liangmu Road, Yuhang District, Hangzhou, Zhejiang Province, China.
If you are dissatisfied with our response, especially where our information processing activities have harmed your lawful rights and interests, you may also seek a solution by bringing a lawsuit before a people’s court with jurisdiction where the Company is located.
This privacy policy was updated and took effect on November 14, 2024.