Privacy Policy

This Policy explains personal information processing for the TominLab website, TominLab accounts, purchases, and support. Where a product has a separate privacy policy, that policy also governs processing within the product.

1. Who we are and scope

1.1The entity responsible for processing your personal information is Hangzhou Tongming Technology Co., Ltd., which operates tominlab.com and related account, licensing, purchase, and support services. Send privacy questions, rights requests, or complaints to support@tominlab.com.

1.2This Policy does not authorize unrestricted collection. We process information only as needed for the features you actually use. Third-party websites and external services you choose have their own privacy rules.

1.3This Policy is available in Chinese and English. In the event of any inconsistency or difference in interpretation, the Chinese version prevails, except where mandatory provisions of applicable law require otherwise.

WonderPen Privacy Policy

2. Information processing list

2.1The following list describes purposes, information categories, and processing by feature. Refusing information necessary for a particular feature may prevent its use, without affecting features that do not need that information.

• Registration, sign-in, and account management: email, username, password verification information, verification codes and status, account identifiers, sessions, and security records are processed to create accounts, verify identity, recover passwords, protect accounts, and manage linked accounts. If you use an available third-party sign-in or linking method, we process the third-party identifier and information returned with your authorization as described at that entry point.
• Purchases, licensing, and redemption: order numbers, products and plans, amounts, purchase times, payment channels and transaction status, license keys, redemption records, delivery email, and linked accounts are processed to verify payments, deliver benefits, provide support, and prevent duplicate claims. Payment providers process information required on their checkout screens; we do not ask you to give support staff your payment password.
• Browsing and secure operation: requested addresses, times, IP addresses, browser or client types, and request and error records are processed to respond to requests, investigate failures, prevent attacks, and meet legal obligations.
• Web usage statistics: website pages use a statistics service operated by us to process visited and referring pages, browser or device type, language, access time, approximate region inferred from IP addresses, and similar information to understand website traffic and usage and improve our pages. This information is not used for advertising profiles or linked to your account.
• Support and feedback: contact information, feedback text, product and version, device or system information, and attachments you choose to upload are processed to respond and resolve issues. Please do not submit unrelated personal information or sensitive information about others.
• Cookies and local storage: sign-in state, security verification, language, display preferences, and purchase-plan preferences are processed for those features, as described in Section 3.

2.2General descriptions in this Policy do not authorize collection for features not actually offered. Before a new feature introduces additional processing, we will explain its purpose, methods, categories, and necessity and obtain consent where required.

2.3Processing is based on your consent, necessity to enter into or perform a contract to which you are a party, necessity to meet legal obligations, or other grounds provided by applicable law. You can withdraw consent to optional processing. Refusal of unnecessary processing will not be used to deny basic services.

2.4Processing without consent is limited to legally specified circumstances and necessary scope. Publicly available information is not available for unrestricted use; significant effects on individual rights and other relevant circumstances are handled according to law.

3. Cookies and similar technologies

3.1We use sign-in session, security verification, and language preference cookies. Session identifiers may be linked to your account, so not all cookies can be treated as anonymous.

3.2Browser local storage holds language, display preferences, purchase-plan selections, and similar settings. You may clear or restrict this data through your browser. This may require signing in again, selecting preferences again, or reopening a purchase flow.

3.3This Policy does not authorize interest-based advertising tracking. The web usage statistics described in Section 2.1 are used only to understand website traffic. If we introduce other optional analytics, marketing, or processing requiring further notice or consent, we will explain it and provide the relevant choices as required by law.

4. Entrusted processing and third-party list

4.1We do not sell personal information or provide feedback and diagnostic logs for third parties’ own marketing or AI training. Necessary cloud storage and email delivery are entrusted to service providers; this does not permit them to use the data independently. As required by law, we agree with these providers on processing purposes, scope, and security obligations and carry out necessary oversight.

Relevant services currently include:

• Alibaba Cloud (Alibaba Cloud Computing Co., Ltd.): infrastructure including cloud storage, backups, and email delivery. It processes necessary business data, recipient addresses, and email content on our behalf according to the hosted function.
• Tencent Cloud (Tencent Cloud Computing (Beijing) Co., Ltd.): object storage and transmission for feedback attachments, processing uploaded attachments, file identifiers, and necessary technical information.
• Resend (Plus Five Five, Inc.): transactional emails such as password recovery and fallback delivery after email failures, processing recipient email, subject and content, and delivery records. Its services involve processing outside China; see Section 5.
• Alipay and WeChat Pay: when you select the relevant payment method, necessary order identifiers, amounts, and payment information are processed. We receive transaction results to confirm purchases and provide support.
• Paddle: when you choose this channel, it processes order, product, amount, email, and checkout information needed to complete the transaction. The contracting entity depends on the buyer’s location and checkout screen and may include Paddle.com Market Limited or Paddle.com Inc.
• Apple: when you purchase or manage subscriptions through Apple, Apple processes its account and payment information. We receive transaction identifiers, products, periods, status, and receipt information needed to verify benefits.
• Digitalychee and other purchase channels: when you buy through a channel and request licensing or support from us, the parties process order and license information as needed to verify purchases, deliver products, and provide support. This does not give the channel access to your works or diagnostic logs.

The providers’ official policies describe their contacts, processing rules, and rights channels:

Alibaba Cloud · Tencent Cloud · Resend · Alipay · WeChat Pay · Paddle · Apple

4.2When providing information to an organization that independently determines the purposes and methods of processing personal information, we give legally required information about the recipient, contact details, purpose, methods, and categories and obtain required separate consent or rely on another applicable legal basis. Contact support for recipient information relevant to your features.

4.3If a merger, division, or business transfer involves a successor receiving personal information, we give legally required notice of the recipient and contact details and require continued protection. Changes in processing purposes or methods require renewed consent where legally required.

4.4We do not proactively publish your personal information. Public disclosure or provision to authorities is limited to appropriate legal grounds and necessary scope, with consent where required. An ordinary commercial contract or complaint does not justify arbitrary public disclosure.

5. Storage locations and processing outside China

5.1Our accounts and principal business data use servers and storage in China. This does not mean that all external services process data only within China: Resend email services and international transaction channels such as Paddle may transfer or process the information they need outside China.

5.2Resend processes recipient addresses, subjects, content, and delivery information on our behalf to deliver transactional emails. Its published storage location is the United States. Rights requests can be made through our support email or the channels in its official privacy policy.

5.3For international payments or other features involving transfers outside China, the recipient, purpose, methods, categories, and rights channels should be explained in the relevant feature notice and recipient policy. We follow applicable transfer requirements. Where separate consent is required, acceptance of the entire service agreement or continued use does not replace it.

6. Retention and deletion

6.1Account information is retained only as needed to maintain the account, perform services, and protect account security. We delete or anonymize information according to law after account deletion, fulfillment of processing purposes, or other statutory deletion conditions.

6.2Order, transaction, and license records are retained as needed for order fulfillment, support, tax, accounting, and other legal obligations. Different records have different retention requirements; a refund does not erase transaction evidence that must still be kept by law.

6.3Uploaded feedback attachments enter scheduled cleanup after 30 days from upload. Feedback text and handling records are retained only as needed to resolve issues and related disputes. Diagnostic logs are used only for internal troubleshooting. They are not published or provided for third parties’ independent purposes. Infrastructure providers may only store and transmit this data within the scope of our instructions.

6.4Retention periods for security, access, and error records are determined separately according to their respective processing purposes and applicable legal requirements. Records are retained for the shortest necessary period, then deleted or anonymized.

6.5Where retention is legally required or deletion from backups is temporarily technically impracticable, processing is limited to storage and necessary security protection until the obligation ends or deletion becomes possible. Account deletion does not mean that all backups and statutory records are physically erased simultaneously.

7. Security

7.1We use reasonable access controls, transmission protection, backups, and permission management. Access is limited to authorized personnel who need it for their duties. Neither the internet nor any storage system can be guaranteed entirely risk-free.

7.2Following a personal information security incident, we take remedial, reporting, and notification measures required by law, explaining potential effects, steps taken or planned, and protective measures available to you.

8. Your rights and account deletion

8.1You may exercise applicable rights to access, copy, correct, supplement, or delete personal information; withdraw consent-based authorization; request explanations; and, where statutory conditions are met, restrict processing or request transfer. Use website account settings or contact support@tominlab.com.

8.2Website account settings provide information management and account deletion options. Before deletion, export needed data, consider linked products and benefits, and separately cancel auto-renewal with Apple or another platform. Account deactivation, online data deletion, backup cleanup, and statutory retention are distinct steps.

8.3We request additional information only as needed to verify identity and protect the account and ordinarily provide an initial response within 3 to 5 working days. If a complex request takes longer, we explain why and provide an estimated timeline. Statutory deadlines prevail where specified.

8.4Withdrawal does not affect lawful consent-based processing before withdrawal. If we cannot fulfill a request, we explain why and available remedies. We will not require you to delete your account for an ordinary correction or inquiry.

9. Updates and contact

9.1Revised policies and their update dates will be published. Major changes will be prominently notified before taking effect. Changes to consent-based processing purposes, methods, or categories require renewed consent where required by law; continued use is not automatically treated as consent.

9.2Send privacy questions, complaints, and rights requests to support@tominlab.com.