Third-Party Information Sharing List
Updated Date: December 15, 2025｜Effective Date: December 15, 2025
Agreement Text
1. Definitions
- Third Party: Refers to institutions or their affiliated entities that independently process data in cooperation with us to achieve specific functions of the product/service or fulfill legal obligations.
- Sharing: Refers to our provision of personal information (including desensitized/anonymized data) to third parties, excluding information independently collected by third parties in their own scenarios.
- De-identification/Anonymization: Refers to processing data so that specific natural persons cannot be identified without additional information; anonymized information is not considered personal information.
2. Statement
To ensure the normal operation and experience optimization of Avatronic Corporation Limited’s products (hereinafter “the Product”) worldwide, Avatronic Corporation Limited (hereinafter “we”) shares necessary information with third parties only on the premise of “enabling service functions, complying with domestic and international laws and regulations, and protecting users’ legitimate rights and interests.” This list strictly follows the Personal Information Protection Law of the PRC, Data Security Law, EU General Data Protection Regulation (GDPR), Japan’s Act on the Protection of Personal Information (APPI), U.S. California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA), and other domestic and international regulations. We adhere to the principles of “minimum necessary, transparency, security and control, cross-border compliance,” clarifying sharing scenarios, scope, and compliance safeguards for global users to review and supervise
3. Sharing Principles
- Lawfulness, Legitimacy, and Necessity: Sharing only when necessary to achieve business functions, ensure security, or fulfill legal obligations.
- Minimum Necessary: Sharing scope is limited to what is necessary to achieve the purpose, excluding full bank card numbers, passwords, and other sensitive payment information.
- Purpose Limitation: Third parties may only process within the agreed purpose scope and not use it for unrelated purposes.
- Security and Control: Measures such as encrypted transmission, access control, and auditing are adopted, and third parties are bound by agreements on confidentiality obligations and compliance responsibilities.
- Transparency and Choice: Users are informed of sharing situations according to law; for scenarios requiring consent, clear authorization and withdrawal paths are provided.
4. Third-Party Information Sharing List
We may share information with third parties in the following scenarios, subject to the actual list of third parties accessed and page prompts. For ease of reading, this list presents the scope of shared information based on the "minimum necessary" principle:
Third-Party Information Sharing List Table
| Sharing Scenario | Third-Party Entity Name | Scope of Shared Information (Minimum Necessary Principle) | Purpose of Sharing | Compliance Basis | Security Measures | User Rights and Notification Methods |
|---|---|---|---|---|---|---|
| Payment Settlement Services | WeChat Pay (Tenpay Payment Technology Co., Ltd.), Alipay (Alipay [China] Network Technology Co., Ltd.), and other compliant payment institutions | Minimum Necessary Fields Order number, transaction amount, payment status, user name (anonymized), contact information (anonymized); does not include full bank card numbers, passwords, or other sensitive payment information | Complete payment settlement for value-added services (membership packages, single-payment features) and ensure transaction security |
1. Obtain explicit user consent 2. Article 13, Paragraph 2 of the Personal Information Protection Law 3. Payment industry regulatory requirements |
1. Sign a Data Processing Agreement (DPA) specifying third-party confidentiality obligations 2. Data transmission uses SSL/TLS 1.3 encryption; 3. Prohibit third parties from using information for purposes other than payment 4. Regularly verify third-party compliance |
1. Notification Method: Payment page pop-up prompt, clearly stated in the "User Service Agreement" 2. Rights: users may check information usage via payment institution channels or contact us to withdraw consent (after withdrawal, the corresponding payment method cannot be used) |
| Security Authentication and Risk Control | Compliant security authentication service providers (e.g., Alibaba Cloud Security, Tencent Cloud Security, etc.) | Minimum Necessary Fields Device information (device model, Android ID/IDFA [anonymized]), network information (IP address [anonymized]), login logs (anonymized), abnormal operation behavior data | Prevent account theft, malicious attacks, fraud, and other security risks, ensuring stable service operation |
1. Article 21 of the Cybersecurity Law 2. Necessary sharing to protect users’ legitimate rights and interests |
1. Sign security cooperation agreements to limit information usage scope 2. Shared data is anonymized/de-identified 3. Third parties must have at least Level 3 security certification 4. Conduct regular security audits |
1. Notification method: explained in the “Information Sharing” section of the Privacy Policy 2. Rights: users may contact us to check sharing records and report any abnormal sharing |
| Customer Support and After-Sales Assistance | Compliant customer service tool providers (e.g., Zhichi Customer Service, NetEase Qiyu, etc.) | Minimum Necessary Fields Account nickname, inquiry description, order information (anonymized), device information (simplified), communication records (excluding sensitive personal information) | Improve customer service response efficiency and quickly resolve user inquiries and after-sales issues (e.g., order inquiries, feature malfunction feedback) |
1. Obtain implied user consent (using the customer service is deemed consent) 2. Article 13, Paragraph 2 of the Personal Information Protection Law |
1. Sign confidentiality agreements prohibiting third parties from retaining or disclosing communication
data 2. Customer service tools deployed on compliant domestic servers 3. Communication records used only for issue handling, retained for no more than 3 years |
1. Notification method: posted on customer service pages and supplemented in the User Service
Agreement 2. Rights: users may request deletion of communication records by contacting customer service |
| Model Optimization (including third-party collaboration) | Compliant AI technology partners (specific entity name required, e.g., “XX Artificial Intelligence Technology Co., Ltd.”) | Minimum Necessary Fields Anonymized AI usage behavior data (e.g., generated content types, feature usage frequency, excluding user personal identity information and original input content); de-identified model training data (anonymized, cannot be linked to individuals) | Optimize AI generation results, improve model accuracy, and enhance product functionality |
1. Obtain explicit user consent (via pop-up authorization) 2. Interim Measures for the Administration of Generative AI Services 3. Data shared after de-identification |
1. Sign AI Model Training Data Sharing Agreement to define data usage boundaries 2. Shared data contains no personal identifiers and cannot be reverse-engineered to identify users; 3. Prohibit third parties from re-sharing with other entities; . Regularly verify compliance of model training |
1. Notification method: separate authorization prompt on AI feature pages, special explanation in the
Privacy Policy; 2. Rights: users may withdraw authorization anytime via “My – Settings – Privacy Center,” after which subsequent data will no longer be shared |
| Push Notification Services | Compliant push service providers (e.g., Jiguang Push, Getui, etc.) | Minimum Necessary Fields Device information (device model, push identifier [OAID/IDFA anonymized]), account identifiers (anonymized), push content-related tags (e.g., membership expiry reminders, feature update notifications) | Send service notifications and entitlement reminders to users, ensuring timely message delivery |
1. Obtain explicit user consent (pop-up authorization on first use); 2. Article 13, Paragraph 2 of the Personal Information Protection Law |
1. Sign push service agreements to limit push scope; 2. Do not share users’ personal identifiers or sensitive data; 3. Allow users to disable push permissions in device settings or within the app |
1. Strictly verify the legal qualifications and documents of authorized entities; 2. Provide only the minimum necessary information within the legal scope; 3. Record and archive sharing activities |
| Statistical Analysis and Product Optimization | Compliant data analytics service providers (e.g., Baidu Analytics, Umeng+, etc.) | Minimum Necessary Fields Anonymized operational behavior data (e.g., feature usage duration, page visit paths, crash logs [anonymized]), basic device information (excluding personally identifiable information) | Analyze product usage, optimize feature design and operational strategies, and enhance user experience |
1. Data anonymized, not linked to personal identity; 2. Article 17 of the Personal Information Protection Law |
1. Sign data analytics agreements prohibiting third parties from re-identifying users; 2. Shared data transmitted via encrypted channels; 3. Regularly audit third-party data processing |
1. Notification method: explained in the “Improving Product and Services” section of the Privacy Policy;
2. Rights: users may contact us to check the scope of statistical analysis and report any unauthorized sharing |
| Legally Required Sharing | Judicial authorities, regulatory agencies, administrative law enforcement authorities, and other authorized legal entities | Minimum Necessary Fields Necessary information as required by legal documents (e.g., account information, order records, within the scope requested by authorized entities) | Comply with laws and regulations and respond to legitimate judicial/administrative orders |
1. Article 13, Paragraph 1 of the Personal Information Protection Law; 2. Legal documents from judicial authorities/regulatory agencies |
1. Strictly verify the legal qualifications and documents of authorized entities; 2. Provide only the minimum necessary information within the legal scope; 3. Record and archive sharing activities |
1. Notification method: unless prohibited by confidentiality requirements, users will be informed via
SMS/in-app message (except in case-related confidentiality); 2. Rights: users may assert related legal rights with the authorized entities |
Remarks
1. This list is a global version and will be dynamically updated according to business adjustments and regulatory changes in different regions. Updates will be published on the official website (global version) and in the app. Significant changes will be prominently notified to users via pop-ups, emails, etc.;
2. We will not sell or rent users’ personal information to any third party. Necessary sharing occurs only in the scenarios listed above, strictly following the principles of “dual compliance” and “data minimization” for cross-border sharing;
3. If users find that a third party is misusing shared information, complaints can be submitted via:
- Global corporate email: hello@avatronics.ai
- International customer service hotline: +86-755-22678897
- EU users may additionally appeal to local Data Protection Authorities (DPA)
- Japanese users may additionally file complaints with the Personal Information Protection Commission
We will immediately investigate and take measures such as suspending sharing, terminating cooperation, and assisting in rights protection;
4. Users can view current effective sharing scenarios via “My – Settings – Privacy Center – Third-Party Sharing Management.” Except for legally required sharing, users may withdraw authorization for specific scenarios (withdrawal may affect corresponding service usage). After withdrawing cross-border sharing authorization, subsequent data transmission to overseas third parties will stop;
5. Cross-border data sharing statement: User data involving the EU, Japan, the US, and other regions complies with SCHREMS II certification (EU), Japan APPI cross-border transfer requirements, and relevant US data privacy frameworks, ensuring secure and compliant cross-border data transmission.
Description: This page is a public disclosure page for third-party information sharing list, used to showcase the information sharing between this product and third parties in specific scenarios.
