Zhixu Privacy Policy

1. Scope of application and operators

This policy applies to the Zhixu web application and its related services operated by 成都一个蘑科技有限公司. We are the processor of Zhixu business data and complete identity authentication through unified account services.

This policy does not apply to third-party websites, external agents or other services that you actively connect, call or authorize. How they handle information should be governed by their respective privacy statements.

2. What information do we process?

We follow the minimum necessary principle. The information actually processed by different functions will be different.

• Account and identity information: Unify account identification, email, nickname, avatar and email verification status for login, identification of data ownership and account security.
• Question bank and data information: question bank name, description, uploaded original DOCX file, file name, size and summary, as well as question stems, options, answers, analysis, original text location and review records extracted from the file.
• Learning record: practice mode, answer options, scoring results, progress, wrong question status and question version, used to continue practicing, form a wrong question bank and display learning results.
• Device and security information: Necessary cookies, session state, hashed IP or device characteristics, browser information, request times, and audit logs for login, abuse prevention, troubleshooting, and data security.
• Browser local data: Answer drafts for unfinished exercises may be temporarily saved in the current browser session and may disappear after exiting the session or clearing the browser data.

3. How we use information

• Create and maintain your private question bank, complete DOCX import, risk review, version release and original text tracing.
• Provides sequential, random, wrong question priority and other practice methods, saves the answer facts and calculates the practice results.
• Maintain login status, resume unfinished tasks, handle failures, resist malicious requests, and ensure service security.
• Analyze service stability and function usage after de-identification or aggregation; we will not disclose your questions or learning records in this way.
• Fulfill applicable laws and regulations, handle disputes and protect the legitimate rights and interests of users, operators or the public.

4. The processing boundary between DOCX and AI

The uploaded DOCX is stored in a private object store and read by a controlled parsing task. The current default import identifies OOXML content through the document structure parser, and does not automatically send the original file or question text to the external generative AI service due to the import action.

The parsing program will generate structured text, candidate questions, document portraits and positioning information for review, tracing and failure recovery. You should avoid uploading sensitive personal information such as identity documents, health, financial accounts, precise location, etc. that are not related to the question bank.

If clearly identified AI or Agent functions are provided in the future, we will only process the necessary content after you actively call or authorize it. When content needs to be transferred to an external model service provider, we will explain the processing purpose, scope and service provider at the function entrance; the modifications generated by AI will be treated as a pending proposal by default and will not silently cover the official topic.

The third-party Agent you actively connect to is selected and controlled by you. Check the scope of permissions and privacy policy before granting permission, and grant only the minimum permissions required to complete the task.

5. Storage period and deletion

• Login session: The access token is a short-term credential; the refresh session is usually retained for up to 30 days and will be stopped after logging out or the credential expires. Necessary security revocation records may continue to be retained for a reasonable period of time.
• DOCX original file: persists while the data is available. After being moved to the Recycle Bin, it will be retained for 7 days for recovery, and will enter permanent cleanup after expiration; when you select permanent deletion, you will directly enter the cleanup process.
• Importing intermediate products: Valid products used for review and traceability are usually saved with the corresponding original files; products that fail or cancel tasks are generally cleared after 7 days, and expired retry products will be cleared earlier.
• Question bank and learning records: Continue to save during normal use of the account to maintain version history, answer facts and wrong question status. After completing valid account cancellation, identifiable business data will in principle be deleted or anonymized within 30 days.
• Enterprise organization business data: After the organization's continuous service expires, it is retained for 12 calendar months. During the retention period, it can still be viewed and exported according to the organization's permissions; after the service is renewed and restored, it will be recalculated according to the new continuous service end time. You cannot start a new exam or retake it after it expires. Exams that have already started can be completed according to the original deadline. Notify the person in charge of the company before liquidation; payment facts and audit records are kept according to their independent rules. Corresponding rules still apply to active deletion and personal space data.
• Backup and logs: Data that has entered the deletion process may remain for up to 90 days due to backup rotation; general security and access logs are kept for no more than 180 days. Records required for legal requirements, dispute resolution or security investigations may be retained for as long as necessary.

6. Sharing, entrusted processing and third-party services

We do not sell your personal information. To run the Services, we may use the following associated capabilities or infrastructure services only to the extent necessary:

• Unified account service: maintained by the same operating entity, used for login, identity verification, session exit and account security.
• Cloudflare: May be used for network security, content distribution and R2 private object storage, saving DOCX and importing products.
• Cloud computing, database, caching and monitoring service provider: used for deploying applications, persisting business data, task scheduling, alarms and troubleshooting.
• The external agent you actively authorize or the AI ​​service provider clearly identified in the future: only receive necessary content within the scope described in the corresponding function.

7. Cookies and session technology

Zhixu uses strictly necessary cookies to save login sessions, anti-cross-site request tokens, and temporary status of the authorization process. These cookies are used for security and core functionality and are not used for cross-site ad profiling. You can manage cookies through your browser, but if you disable necessary cookies, you will not be able to log in or use features that require authentication.

8. Your rights

Within the scope permitted by applicable laws, you can access, correct, delete your own question bank information, withdraw specific authorization, or apply to cancel your account. Part of the version history and answer facts are immutable records to prevent the learning results that have occurred from being silently rewritten; when the account is logged out, we will delete or de-identify it.

Please submit account and privacy applications through the official website contact page. Your identity and relevant authorization must be verified before processing.

9. Security protection

We reduce the risk of data leakage, tampering or abuse through measures such as access control, user data isolation, private storage, transmission encryption, credential hashing, request verification and audit records. No system can guarantee absolute security. Please protect your account credentials properly and do not add sensitive information unrelated to learning to the question bank.

10. Minors

Zhixu is not a service specifically designed for children under the age of 14. Minors should use it under the guidance and consent of their guardians. If we discover that children's personal information has been processed without appropriate consent, we will take measures such as deletion as soon as possible after verification.

11. Policy update

When there are important changes in functions, data processing methods or service providers, we will update this policy and page date; if changes that have a significant impact on your rights and interests are involved, you will be notified separately through reasonable means such as page prompts. Please read the updated content before continuing.