Privacy Policy
Last updated: 6 November 2026
Hangzhou Baoxian Supply Chain Management Co., Ltd. ("we", "us") operates the LayoutAudit web application (the "Service"). This policy explains what personal data we collect, why, and what rights you have.
Registered address: Room 3008, Building 1, No. 289 Desheng Road, Gongshu District, Hangzhou, Zhejiang, China. Contact: [email protected]
1. Data we collect
Account data — name, email address, password hash, company name, country. Required to create and secure an account.
Billing data — we do not receive or store your card details. Purchases are processed by Paddle.com Market Ltd. as Merchant of Record. We receive order confirmations, subscription status, tax country, and a masked payment reference. See Paddle's privacy policy at https://www.paddle.com/legal/privacy.
Plan and usage data — floor plans you upload or draw, room and furniture markers, north orientation, generated reports, and basic usage events (login times, features used, report counts). Required to provide the Service.
Technical data — IP address, browser and device type, referring page. Used for security, fraud prevention, and aggregate analytics.
Support data — the content of messages you send us.
We do not collect biometric data, do not use the Service to infer health, religion, ethnicity, or any special category of personal data, and do not use your plans to train machine-learning models.
2. Why we process it, and our legal bases (GDPR Art. 6)
| Purpose | Legal basis |
|---|---|
| Create and operate your account, generate reports | Performance of a contract |
| Process payments and issue invoices | Performance of a contract |
| Prevent fraud and abuse, secure the Service | Legitimate interests |
| Respond to support requests | Performance of a contract / legitimate interests |
| Send service notices (downtime, material changes) | Performance of a contract |
| Send product updates and offers | Consent, or legitimate interests where permitted — opt out at any time |
| Comply with tax, accounting, and legal obligations | Legal obligation |
3. Sharing
We share personal data only with:
- Paddle.com Market Ltd. — payment processing, tax calculation and remittance, order support (independent controller for its own obligations)
- Cloud hosting and storage providers — servers located in the European Union, the United States, or Singapore, used solely to host the Service and store plan data at rest
- Email delivery providers — to send transactional and account emails
- Analytics providers — aggregated, non-identifying usage statistics
- Professional advisers and authorities — where required by law, court order, or to establish or defend legal claims
We do not sell personal data and do not share it for cross-context behavioural advertising.
4. International transfers
We are established in China and use service providers in the EU, the US, and Singapore. Where personal data of EU/UK residents is transferred outside the EEA/UK, we rely on Standard Contractual Clauses or an equivalent lawful transfer mechanism, together with supplementary technical measures (encryption in transit and at rest).
5. Retention
| Data | Retention |
|---|---|
| Account and plan data | While your account is active, then deleted within 90 days of account closure |
| Generated reports | While your account is active; you may delete them at any time |
| Billing records | As required by tax and accounting law (up to 10 years) |
| Support correspondence | 24 months |
| Server logs | 90 days |
6. Security
Access to production systems is restricted and logged. Data is encrypted in transit (TLS 1.2+) and at rest. Passwords are stored as salted hashes. We run periodic backups and review access rights.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the competent authority without undue delay and, where required, within 72 hours of becoming aware.
7. Your rights
Depending on where you live, you may have the right to: access your data; correct it; delete it; restrict or object to processing; portability; withdraw consent; and lodge a complaint with a supervisory authority.
To exercise any right, email [email protected]. We respond within 30 days. You may also manage or delete your data from within the account settings.
California residents (CCPA/CPRA): you have the right to know, delete, correct, and opt out of sale or sharing. We do not sell or share personal information as those terms are defined by the CPRA. We do not discriminate against you for exercising your rights.
8. Cookies
We use strictly necessary cookies for authentication and session management, and — with your consent where required — analytics cookies. You can withdraw consent or block cookies in your browser; strictly necessary cookies cannot be disabled without breaking the Service.
9. Children
The Service is not directed to anyone under 18, and we do not knowingly collect data from children.
10. Changes
We will post any update on this page and change the "Last updated" date. Material changes will be notified by email at least 14 days in advance.
11. Contact
Hangzhou Baoxian Supply Chain Management Co., Ltd. Room 3008, Building 1, No. 289 Desheng Road, Gongshu District, Hangzhou, Zhejiang, China Email: [email protected]