Privacy Policy

⚠ This document is a placeholder draft. It must be reviewed and approved by legal counsel before launch (see task #12).

1. Introduction & Scope

This Privacy Policy ("the Policy") is published by TA Studio ("we", "us", "our") and governs all scenarios in which you visit, browse, or use this website, or submit information to us through it. We respect and protect your personal information in accordance with applicable law. The Policy explains what we collect, how we use, store, share, and safeguard your information, and the rights you have and how to exercise them.

The Policy does not apply to third-party websites or services that you reach via links from this site.

2. Information We Collect

We collect only the categories of information necessary to provide the service:

• Information you actively submit: e.g., the name, email, category, and message body submitted via the Contact form.
• Device & log information: IP address, User-Agent (browser/OS identifier), access timestamp, request path, and Referer automatically recorded by our servers.
• Cookies & similar technologies: for session continuity, language preference, and other necessary functional cookies; see Section 7.
• Voluntary feedback: text you choose to submit through blog comments, feedback forms, etc.

We do not collect sensitive personal information such as government ID numbers, faces, fingerprints, or payment card numbers via this website.

3. How We Use Your Information

• To respond to inquiries or collaboration requests submitted through Contact.
• To maintain the security and reliable operation of the site (anti-abuse, rate limiting, troubleshooting).
• To improve usability and content quality based on aggregate statistics, never targeting individuals.
• To comply with applicable legal obligations.

We will not use your information for purposes outside the above without your additional consent.

4. Retention Periods

• Form submissions: retained for at most 24 months from the date of resolution, then deleted or anonymized.
• Server access logs: retained by default for 90 days for security and troubleshooting, then rotated out.
• If you withdraw consent or close your account (when accounts exist), we will stop processing within a reasonable period and delete per the rules above.

5. Sharing, Transfer, and Public Disclosure

We do not sell your personal information to any third party. We share necessary information only in the following cases:

• Necessary third-party processors: e.g., object storage (such as Tencent Cloud COS), CDN, email delivery, error monitoring. We provide only the minimum information needed and bind processors via contracts to handle data in line with this Policy and applicable law.
• Legal obligations: where required by valid laws, regulations, judicial or administrative authorities.

For any sharing or transfer involving personal information, we will inform you of the purpose, recipient type, and possible risks in advance.

6. Your Rights

Under PIPL and other applicable laws, you have the following rights regarding your personal information. You may exercise them through the channels in Section 12:

• Access: know what we process about you.
• Correction: request correction of inaccurate or incomplete information.
• Deletion: request deletion under qualifying circumstances.
• Portability: request export in a common format or transfer to a designated recipient where qualifying.
• Withdraw consent: revoke previously granted consent; withdrawal does not affect processing performed in reliance on it before withdrawal.
• Account closure: request closure of any future account.
• Copy: request a copy of your personal information.

We will verify and respond to requests within 15 working days of receipt.

7. Cookies

We use the following categories of cookies:

• Strictly necessary: language preference, CSRF protection, login state (if enabled), and other basic functions.
• Statistical (optional): enabled only with your consent; used for aggregate analytics, not for individual identification.

You can refuse cookies via your browser settings; some features may then be unavailable.

8. Minor Protection

This site is intended for adult users. We do not knowingly collect personal information from children under 14. If you are a guardian and discover that a child has submitted information without your consent, please contact us via Section 12 and we will delete it as soon as possible.

9. Security Measures

• HTTPS (TLS 1.2+) enforced site-wide.
• Minimization and shortest-possible retention for sensitive fields.
• Server-side access auditing and routine vulnerability scanning.
• Vetting of third-party processors for qualifications and compliance.

Despite these measures, no internet transmission is 100% secure. Please understand the risks and protect your devices and accounts accordingly.

10. Cross-Border Transfers

In the P1 phase, this site's servers and data storage are located within mainland China. No cross-border transfer of personal information is currently performed. If a future change requires cross-border transfer (e.g., enabling overseas CDN or email service), we will update this Policy in advance and, where required, obtain your separate consent and complete any legally required security assessment.

11. Changes to This Policy

We may update this Policy due to business or legal changes. Material changes will be announced prominently on the site or via email. The "Last updated" and "Version" markers appear at the top of this page.

12. Contact Us

To exercise the rights in Section 6, or for any questions, complaints, or suggestions about this Policy, please contact us via the email addresses listed on our Contact page. For deletion requests, please mark the email subject "Personal Information Deletion Request" so we can process it promptly.