Privacy Policy
1. Identity and Scope
This Privacy Policy is published by 丽水市铸梦网络科技有限公司 (English reference name: Lishui Zhumeng Network Technology Co., Ltd., "the Company", "we", "us"), the developer and operator of 跨境智营（TikTok版） ("Kuajing Zhiying (TikTok Edition)", "the Service"), an e-commerce operations platform for TikTok Shop merchants, and of this website at https://erp.xsjtoken.com/.
This Policy explains how we collect, use, store, disclose, and protect personal information in connection with the Service and this website. It applies to merchants and their staff who use the Service, and to personal information of buyers that merchants process through the Service.
2. Roles of the Merchant, TikTok Shop, and the Company
- Merchants who connect their TikTok Shop stores to the Service determine the purposes of processing buyer personal data obtained from their stores. For such data, the merchant acts as the personal information handler (controller), and the Company processes the data on the merchant's behalf and under the merchant's instructions as an entrusted party (processor).
- TikTok Shop is an independent platform operated by its own operators under their own terms and privacy policies. This Policy does not cover TikTok Shop's own processing.
- The Company acts as a personal information handler for the account, usage, security, and website data described below that we collect for our own service operation purposes.
3. Categories and Sources of Personal Data
Depending on the functions a merchant enables, the Service may collect or receive:
- Merchant, user-account, shop, and authorization information (e.g., registered account name, contact email, tenant and shop identifiers, roles and permissions);
- TikTok Shop access tokens, refresh tokens, and authorization metadata (scopes, validity, shop bindings);
- Product, inventory, warehouse, order, return, refund, fulfillment, and logistics data synchronized from authorized TikTok Shop stores;
- Buyer or recipient personal data contained in the above, including name, telephone number, delivery address, and order-related information;
- Service usage, device, IP address, security, access, and audit log data;
- Support requests and business communications you send to us.
Sources are: the merchant and its staff directly; TikTok Shop official APIs under the merchant's explicit authorization; and automatic collection of technical logs when the Service or website is used. We request or access only the data required for the service functions the merchant has authorized.
4. Processing Purposes and Legal / Authorization Basis
We process personal data to: provide the authorized service functions (such as product, order, inventory, fulfillment, procurement, customer service, promotion, and finance management); maintain account security, permissions, and audit trails; provide support; meet legal and regulatory obligations; and prevent fraud and abuse.
Our basis for processing is the performance of our service agreement with the merchant, the merchant's instructions and TikTok Shop OAuth authorization, legal obligations, and, where applicable, consent. We do not sell personal data. We do not use TikTok Shop data for profiling unrelated to the Service or for our own independent advertising.
5. Data Minimization and TikTok Shop API Permissions
We follow the principle of data minimization. We request only the TikTok Shop API scopes required for the business functions the merchant chooses to use, and we access only the data necessary to perform those functions. Merchants can review the scopes requested during the TikTok Shop authorization flow at any time.
6. Disclosures
We disclose personal data only as follows:
- Service providers: infrastructure providers that host our systems (currently cloud infrastructure located in mainland China, e.g., Alibaba Cloud), engaged under confidentiality and data-protection obligations. A current list of subprocessor categories is available upon request via the contact below;
- The merchant: data belonging to a merchant's tenant is accessible to that merchant's authorized users according to the roles and permissions the merchant configures;
- TikTok Shop: data is transmitted to TikTok Shop through official APIs when performing the functions the merchant instructs (e.g., publishing products, fulfilling orders, replying to buyers);
- Authorities: where disclosure is required by applicable law, regulation, or binding legal process.
Tenant data is strictly isolated: one merchant's data is never disclosed to another merchant.
7. Processing Location and International Transfer
Our primary systems store and process personal data in mainland China. If you or your buyers are located outside mainland China, personal data processed through the Service may therefore be transferred to and processed in mainland China. Such transfers are carried out subject to applicable law, the merchant's instructions, platform requirements, and appropriate safeguards.
8. Retention, Merchant Disconnection, Token Revocation, and Deletion
- We retain personal data only for the shortest period necessary for the authorized service functions and for legal, contractual, security, and dispute-resolution purposes.
- By default, buyer personal data used for order and after-sales operations is deleted or irreversibly anonymized within 180 days after the related order or service case ends, unless a complaint, dispute, investigation, or legal hold requires longer retention.
- When a merchant disconnects a shop, revokes authorization, or terminates the Service, we stop the related processing and delete the TikTok Shop access tokens, refresh tokens, and applicable customer data of that shop from active systems within 30 days.
- Residual copies in backups expire and are overwritten in the ordinary course within 90 days thereafter.
- Records that must be kept longer under applicable law (e.g., financial transaction records, which may be retained for up to 7 years) are retained only for that purpose, access-restricted, and deleted when the obligation ends.
9. Security Safeguards
We apply technical and organizational measures appropriate to the risk, including: encrypted storage of access credentials and tokens; exclusion of tokens and secrets from business tables, logs, and client applications; strict tenant isolation enforced at the server side; role-based access control and least privilege; append-only audit logging of key operations; and transport encryption (HTTPS) for this website and service endpoints. No method of transmission or storage is completely secure, but we work continuously to protect personal data against unauthorized access, disclosure, alteration, and loss.
10. Your Rights and the Merchant-Assisted Request Workflow
Under applicable law, including the PRC Personal Information Protection Law, individuals may have rights to access, copy, correct, supplement, delete, and restrict the processing of their personal information, and to withdraw consent.
- Buyers: if your personal data was processed through a merchant's store, please first contact the merchant you purchased from, as the merchant controls that data. We assist merchants in fulfilling verified requests without undue delay.
- Merchants and their staff: you may exercise your rights over your account data by contacting us directly using the contact details below.
- If you contact us directly about merchant-controlled data, we will route your request to the relevant merchant and provide reasonable assistance.
We respond to verified requests within the timeframes required by applicable law.
11. Children's Data
The Service is a business tool intended for merchants and their staff and is not directed to children. We do not knowingly collect personal information of children for our own purposes. Buyer data is processed only as instructed by merchants; if we become aware that children's personal information has been processed contrary to applicable law, we will take appropriate steps, including deletion.
12. Cookies and Website Technical Data
This website (erp.xsjtoken.com) is a static informational site. It does not set cookies and does not use third-party analytics or advertising trackers. A small amount of data is stored locally in your browser (browser localStorage) and stays on your device; it is never transmitted to us:
- Marketing pages (this site):
lang— the interface language you selected. - Web console (
/console/, the same application as our desktop client):erp.locale— the interface language you selected;erp-session— your sign-in session token and the company/permission profile needed to keep you signed in;prototype.autonomousVoiceEnabled— a user interface preference. Signing out clears the session entry.
Our web server records standard access logs (IP address, user agent, request time) for security and operations purposes; these logs are kept for a limited period necessary for those purposes and are then deleted or rotated.
13. Incident Notification
If a security incident affecting personal data occurs, we will promptly assess and contain it, remediate the cause, and notify affected merchants, and where required, regulators and affected individuals, in accordance with applicable law and TikTok Shop platform requirements, without undue delay.
14. Policy Updates
We may update this Policy from time to time. Updates are published on this page with a revised "Last updated" date. For material changes, we will additionally notify merchants through the Service or by other reasonable means. Continued use of the Service after an update takes effect constitutes acceptance of the updated Policy to the extent permitted by law.
15. Contact
丽水市铸梦网络科技有限公司 (Lishui Zhumeng Network Technology Co., Ltd.)
Lishui City, Zhejiang Province, China
Privacy contact email: a942263534@outlook.com
Website: https://erp.xsjtoken.com/
We will verify your identity before acting on a request concerning personal information.
一、身份与适用范围
本隐私政策由丽水市铸梦网络科技有限公司（下称「本公司」或「我们」）发布。本公司是面向 TikTok Shop 商家的电商运营平台「跨境智营（TikTok版）」（下称「本服务」）及本网站（https://erp.xsjtoken.com/）的开发者与运营者。
本政策说明我们在本服务及本网站相关活动中如何收集、使用、存储、披露和保护个人信息，适用于使用本服务的商家及其员工，以及商家通过本服务处理的买家个人信息。
二、商家、TikTok Shop 与本公司的角色
- 商家将其 TikTok Shop 店铺接入本服务后，决定其店铺买家个人数据的处理目的。就该等数据，商家为个人信息处理者，本公司作为受托方，按商家的委托和指示进行处理。
- TikTok Shop 是由其运营方独立运营的平台，适用其自身的条款与隐私政策；本政策不涵盖 TikTok Shop 自身的处理活动。
- 就下文所述的账号、使用、安全与网站数据，本公司为实现自身服务运营目的而处理，作为个人信息处理者。
三、个人数据的类别与来源
根据商家启用的功能，本服务可能收集或接收：
- 商家、用户账号、店铺与授权信息（如注册账号名、联系邮箱、租户与店铺标识、角色与权限）；
- TikTok Shop 访问令牌、刷新令牌及授权元数据（权限范围、有效期、店铺绑定关系）；
- 从已授权 TikTok Shop 店铺同步的商品、库存、仓库、订单、退货、退款、履约与物流数据；
- 上述数据中包含的买家或收件人个人数据，包括姓名、电话号码、收货地址及订单相关信息；
- 服务使用、设备、IP 地址、安全、访问与审计日志数据；
- 您向我们发送的支持请求与业务沟通内容。
数据来源包括：商家及其员工直接提供；经商家明确授权通过 TikTok Shop 官方 API 获取；以及使用本服务或本网站时自动收集的技术日志。我们仅请求或访问商家已授权的服务功能所必需的数据。
四、处理目的与法律/授权依据
我们处理个人数据的目的包括：提供经授权的服务功能（商品、订单、库存、履约、采购、客服、推广与财务管理等）；维护账号安全、权限与审计记录；提供支持服务；履行法律法规义务；防范欺诈与滥用。
处理依据为：与商家订立的服务协议之履行、商家的指示与 TikTok Shop OAuth 授权、法定义务，以及（如适用）个人同意。我们不出售个人数据；不将 TikTok Shop 数据用于与本服务无关的用户画像，也不将其用于本公司自身的独立广告活动。
五、数据最小化与 TikTok Shop API 权限
我们遵循数据最小化原则：仅申请商家所选业务功能必需的 TikTok Shop API 权限范围（Scope），且仅访问执行该等功能所必要的数据。商家可在 TikTok Shop 授权流程中随时查看所申请的权限范围。
六、对外披露
我们仅在以下情形披露个人数据：
- 服务提供商：为我们提供系统托管的基础设施服务商（目前为位于中国大陆的云基础设施，如阿里云），其受保密与数据保护义务约束。当前分包处理者类别清单可通过下方联系方式索取；
- 商家本身：商家租户内的数据按其配置的角色与权限向该商家的授权用户开放；
- TikTok Shop：在执行商家指示的功能（如刊登商品、订单履约、回复买家）时，通过官方 API 向 TikTok Shop 传输数据；
- 主管机关：适用法律、法规或有约束力的法律程序要求披露时。
租户数据严格隔离：任何商家的数据不会被披露给其他商家。
七、处理地点与跨境传输
我们的主要系统在中国大陆存储和处理个人数据。如您或您的买家位于中国大陆境外，通过本服务处理的个人数据可能因此被传输至中国大陆并在当地处理。该等传输将遵守适用法律、商家指示、平台要求，并采取适当的保障措施。
八、保留、商家断连、令牌撤销与删除
- 我们仅在实现经授权的服务功能及法律、合同、安全与争议解决目的所必需的最短期间内保留个人数据。
- 默认情况下，用于订单与售后运营的买家个人数据在相关订单或服务案件结束后 180 天内删除或不可逆匿名化；投诉、争议、调查或法律冻结要求更长保留的除外。
- 商家断开店铺连接、撤销授权或终止服务时，我们将停止相关处理，并在 30 天内从生产系统中删除该店铺的 TikTok Shop 访问令牌、刷新令牌及相应客户数据。
- 备份中的残留副本在其后 90 天内按备份周期自然过期并被覆盖。
- 适用法律要求更长保存期限的记录（如财务交易记录，可能最长保存 7 年），仅为该目的保留、限制访问，并在义务终止后删除。
九、安全保障措施
我们采取与风险相适应的技术和组织措施，包括：访问凭据与令牌加密存储；令牌与密钥不进入业务表、日志与客户端；服务端强制执行的严格租户隔离；基于角色的访问控制与最小权限；关键操作只追加（不可篡改）的审计日志；本网站与服务端点的传输加密（HTTPS）。任何传输或存储方式都无法保证绝对安全，但我们将持续努力保护个人数据免遭未经授权的访问、披露、篡改与丢失。
十、您的权利与商家协助流程
根据《中华人民共和国个人信息保护法》等适用法律，个人有权查阅、复制、更正、补充、删除其个人信息，限制处理及撤回同意。
- 买家：如您的个人数据经由某商家店铺处理，请优先联系您购买商品的商家（该数据由商家控制）。我们将协助商家及时处理经核验的请求。
- 商家及其员工：可直接通过下方联系方式对您的账号数据行使权利。
- 如您就商家控制的数据直接联系我们，我们会将请求转交相关商家并提供合理协助。
我们将在适用法律要求的期限内响应经核验的请求。
十一、儿童数据
本服务是面向商家及其员工的企业工具，不面向儿童。我们不会为自身目的有意收集儿童个人信息。买家数据仅按商家指示处理；如我们发现儿童个人信息被违法处理，将采取包括删除在内的适当措施。
十二、Cookie 与网站技术数据
本网站（erp.xsjtoken.com）为静态信息展示网站，不设置 Cookie，不使用第三方统计分析或广告跟踪器。我们会在您的浏览器本地（localStorage）保存少量数据，该等数据仅存于您的设备，不会传输给我们：
- 官网页面（本站）：
lang—— 您选择的界面语言。 - Web 控制台（
/console/，与桌面客户端同一套应用）：erp.locale—— 您选择的界面语言；erp-session—— 保持登录所需的会话令牌与企业/权限画像；prototype.autonomousVoiceEnabled—— 一项界面偏好。退出登录会清除会话条目。
我们的 Web 服务器出于安全与运维目的记录标准访问日志（IP 地址、User-Agent、请求时间），该等日志仅在实现上述目的所必需的有限期间内保存，随后删除或轮转覆盖。
十三、安全事件通知
如发生影响个人数据的安全事件，我们将及时评估与遏制、修复原因，并按照适用法律和 TikTok Shop 平台要求，及时通知受影响的商家，以及（如法律要求）监管机构与受影响的个人。
十四、政策更新
我们可能不时更新本政策。更新将发布于本页面并标注新的「最近更新」日期；重大变更还将通过本服务或其他合理方式通知商家。更新生效后继续使用本服务，即视为在法律允许范围内接受更新后的政策。
十五、联系方式
丽水市铸梦网络科技有限公司
中国 浙江省 丽水市
隐私联系邮箱：a942263534@outlook.com
网站：https://erp.xsjtoken.com/
在处理涉及个人信息的请求前，我们将先核验请求人身份。