Privacy Policy

Effective Date: [TBD upon publication] Last Updated: 2026-06-27 Version: 1.0 (Draft · CN entity / Paddle MoR)

This Privacy Policy explains what personal information Hangzhou Wanxiang Xunsheng Technology Co., Ltd. (杭州万像循声科技有限公司) (“the Company”, “we”, “us”) collects about you when you use SoundSeeker (the “Service”), how we use it, when and with whom we share it, and the rights you have.

SoundSeeker is privacy-by-design: most processing of your audio assets, search queries, and project data occurs locally on your device. Our servers handle only the minimum personal information needed for account, billing, and security.

---

Quick Summary (informational only — the binding text follows)

• What we collect: account identifiers (email; phone where required), a non-reversible hash of a machine identifier (for license activation), short-lived IP addresses, basic device/usage telemetry, and payment metadata returned by our payment processors.
• What we explicitly do not collect or upload: your audio files, your search queries, your project data, your browsing history, third-party tracking cookies.
• Why we collect it: to provide and secure the Service, fulfill the purchase contract, comply with law, and improve the product.
• We do not sell your personal information.
• We do not train AI models on your data, and we contractually prohibit any third-party model providers we use from doing so.
• Your rights: access, correction, deletion, portability, objection, withdrawal of consent, and (where applicable) the right to opt out of certain processing. See Section 7.

---

1. Scope and Controller

1.1 This Policy applies to personal information processed in connection with the Service, including the SoundSeeker desktop application, web access, and related tools.

1.2 The entity responsible for your personal information is Hangzhou Wanxiang Xunsheng Technology Co., Ltd. (杭州万像循声科技有限公司) (“the Company”), a company incorporated in Mainland China (Hangzhou, Zhejiang Province). Under China’s Personal Information Protection Law (“PIPL”), the Company is the personal information handler (个人信息处理者) for the processing described here. Under the GDPR and analogous laws, the Company acts as the data controller. Where local law requires a representative or contact point, our representatives are listed in Section 12.

1.2.1 Sales are completed through Paddle as Merchant of Record. When you purchase a SoundSeeker license, the transaction is completed through Paddle.com Market Limited (“Paddle”), our authorized reseller and Merchant of Record. Paddle is the seller of record for your purchase and is an independent personal information handler / data controller for the payment and billing data it collects from you, governed by Paddle’s own privacy notice (https://www.paddle.com/legal/privacy). This Policy covers the personal information the Company processes to provide and secure the Service; it does not cover Paddle’s independent processing of your payment data.

1.3 If you use a version of SoundSeeker provided by an organization (e.g., a team or enterprise edition administered by your employer or school), that organization may be the controller for some processing; in that case, please consult their privacy notice.

2. Personal Information We Collect

We collect only what we need. The categories below are exhaustive in the ordinary course of operation:

2.1 Account information

• Email address (required) — to create your account and contact you about the Service.
• Phone number (optional in most regions; required where local regulation mandates) — for two-factor verification or account recovery.
• Display name (optional) — what we show in the product UI.

2.2 License and device information

• Machine identifier hash — a one-way SHA-256 hash derived from stable hardware identifiers, used to bind your license to your device. The raw identifier is not transmitted; only the hash.
• Operating system, application version, and locale — to deliver compatible updates and to localize the UI.

2.3 Connection and security information

• IP address — observed at sign-in, license verification, and update checks; retained for a short period for fraud and abuse detection.
• Activation and heartbeat events — timestamps and outcomes (success / fail / rate-limited), used to detect license abuse.
• Login and authentication logs — used to investigate security incidents.

2.4 Payment information

• Order metadata — purchase amount, SKU, currency, billing country, and a reseller order reference (token) returned to us by Paddle.
• We do not receive or store full payment card numbers. Your payment is collected by Paddle.com Market Limited (“Paddle”), our Merchant of Record and authorized reseller, which is the seller of record for the transaction. Paddle collects and processes your full payment details under its own privacy notice (https://www.paddle.com/legal/privacy); the Company receives only the order metadata above to provision your license and provide support.

2.5 Customer support information

• Support tickets — the content you send us (email, attachments) when you request help.

2.6 Cookies and similar technologies (web/marketing site)

• See our Cookie Policy for the list of cookies set when you visit our marketing or account-management website. We use a consent banner where required by applicable law.

3. Information We Do Not Collect

We have designed the Service so that the following information is not transmitted to or stored by our servers in the ordinary course of operation:

• The contents of your audio files;
• Your search queries inside the Service;
• Your project files and metadata kept inside the Service;
• A history of which sounds you played, dragged, or used in your projects;
• Web-browsing data unrelated to our Service.

Local processing occurs on your device. If a future feature requires server-side processing of any of the above (for example, an opt-in cloud sync), we will request your separate, informed consent at the point of activation and update this Policy.

4. Why We Process Your Information (Purposes and Legal Bases)

The following table sets out the purposes for which we process personal information and, where the GDPR or analogous law applies, the corresponding legal basis.

Purpose	Categories used	GDPR legal basis (where GDPR applies)
Create and maintain your account	Account info	Contract necessity (Art. 6(1)(b))
License activation and verification	Machine hash, license events	Contract necessity (Art. 6(1)(b))
Process payments and provide receipts	Payment metadata, account info	Contract necessity (Art. 6(1)(b)); legal obligation (Art. 6(1)(c))
Detect and prevent fraud, abuse, license circumvention	Connection info, security logs	Legitimate interest (Art. 6(1)(f)) — balanced against your rights
Provide customer support	Support tickets, account info	Contract necessity / legitimate interest
Deliver product updates and security advisories	Account info, version	Contract necessity / legal obligation
Improve the product (aggregated, anonymized)	De-identified telemetry	Legitimate interest (Art. 6(1)(f))
Send service announcements you cannot opt out of (e.g., billing, security)	Account info	Contract necessity / legal obligation
Send optional marketing communications	Account info	Consent (Art. 6(1)(a)); you may withdraw at any time
Comply with legal obligations and respond to lawful requests	As applicable	Legal obligation (Art. 6(1)(c))

We do not use AI to make decisions about you that produce legal or similarly significant effects (GDPR Art. 22). We do not engage in profiling for behavioral advertising.

5. AI Processing — No Training on Your Data

5.1 SoundSeeker uses discriminative AI techniques (e.g., similarity search, audio classification) on your device. These models do not generate new audio content.

5.2 We do not use your audio files, search queries, project data, or any other content you process with the Service to train, fine-tune, or improve our AI models or those of any third party.

5.3 Where we rely on third-party model providers for ancillary functions, our contracts with them prohibit them from using your data to train their models.

5.4 This Section is a binding commitment. It is also referenced in Section 7 of the EULA.

6. Sharing and Recipients

We do not sell your personal information. We share it only with:

6.1 Merchant of Record (Paddle)

• Paddle.com Market Limited — our Merchant of Record and authorized reseller, which is the seller of record for your purchase. Paddle collects your payment, calculates and remits applicable taxes, issues receipts/invoices, and processes refunds and chargebacks. Paddle acts as an independent personal information handler / data controller for the payment data it collects, under its own privacy notice. We share with Paddle, and receive back, only the order metadata needed to provision and support your license.

6.2 Service providers (entrusted parties / processors)

• Cloud and hosting providers — to host our authentication and license servers.
• Email delivery providers — to send transactional and (with your consent) marketing emails.
• Analytics provider — to understand aggregate website usage (see Cookie Policy).
• Customer-support tooling — to manage support tickets.

Under PIPL Article 21, we entrust these providers only under a written agreement specifying the purpose, period, and means of processing; under the GDPR we bind each as a processor by a written data-processing agreement that limits them to processing on our instructions and to the extent necessary.

6.3 Professional advisors

• Legal counsel, auditors, and accountants, where strictly necessary.

6.4 Authorities

• Law enforcement, regulators, courts, and other public authorities, where required by law and where we have determined in good faith that disclosure is legally required. We narrow disclosures and challenge overbroad requests where appropriate.

6.5 Business transfers

• In a merger, acquisition, financing, or sale of assets, personal information may be transferred to the successor entity, which will be bound by this Policy or an equivalent.

A current list of categories of processors is available on request at [email protected].

7. Your Rights

The rights below are available to all users to the maximum extent the Company can deliver them in a single global workflow. Specific statutory rights are highlighted where they go further.

7.1 Universal rights

• Access the personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Delete your account and the personal information associated with it, subject to retention exceptions for legal compliance, security, and dispute resolution.
• Portability — receive a copy of certain account information in a commonly used machine-readable format.
• Withdraw consent at any time, where we rely on consent. Withdrawal does not affect lawfulness of prior processing.
• Object to processing based on legitimate interest, on grounds relating to your particular situation.

7.2 Mainland China (PIPL) — your rights as a personal information subject

Because the Company is established in Mainland China, the Personal Information Protection Law (“PIPL”) applies to our processing. In addition to the universal rights above, you have the right to:

• Know and decide about the processing of your personal information, and to limit or refuse the processing of your personal information by others, except as otherwise provided by law (PIPL Art. 44).
• Access and copy your personal information (PIPL Art. 45).
• Correct or supplement inaccurate or incomplete personal information (PIPL Art. 46).
• Delete your personal information where the purpose has been achieved, the retention period has expired, you withdraw consent, we have processed it in violation of law or agreement, or we cease providing the Service (PIPL Art. 47).
• Request an explanation of our personal-information processing rules (PIPL Art. 48).
• Withdraw consent where processing is based on consent; withdrawal does not affect the lawfulness of processing carried out before withdrawal (PIPL Art. 15).
• Have your close relatives exercise the rights above with respect to your relevant personal information after your death, for their own lawful and legitimate interests, unless you arranged otherwise during your lifetime (PIPL Art. 49).

We process your personal information on the lawful bases set out in PIPL Article 13 — principally the necessity to conclude or perform the contract to which you are a party (your license and account), the necessity to fulfill statutory duties or obligations, and, where applicable, your consent (which we obtain separately where the law requires separate consent, e.g., for any cross-border provision of your personal information — see Section 9). We collect only the minimum personal information necessary to achieve the stated purposes (PIPL Art. 6).

7.3 EEA / UK (GDPR, UK GDPR) — additional rights

• Restrict processing in defined cases (GDPR Art. 18).
• Right not to be subject to solely automated decision-making producing legal or similarly significant effects (GDPR Art. 22). We do not engage in such processing.
• Lodge a complaint with your supervisory authority. A list of EEA supervisory authorities is available at the European Data Protection Board: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en.

7.4 California (CCPA / CPRA) — additional rights

• Right to know what personal information we collect, use, disclose, and sell or share.
• Right to delete.
• Right to correct.
• Right to opt out of sale or sharing — we do not sell or share your personal information for cross-context behavioral advertising. We honor the Global Privacy Control (GPC) signal.
• Right to limit use of sensitive personal information — we do not use sensitive personal information for any purpose beyond providing the Service.
• We do not discriminate against you for exercising any CCPA right.

7.5 Japan (APPI) — additional rights

• Right to request disclosure, correction, addition, deletion, or cessation of use of your “retained personal data”.
• For users in Japan, in describing our purposes of use, we will use plain Japanese on request.
• Where we disclose personal data to recipients in a third country, we explain the country and the protections in place (see Section 9).

7.6 South Korea (PIPA) — additional rights

• Right to request access, correction, deletion, and suspension of processing of your personal information.
• Where applicable, we provide the legally required disclosures regarding cross-border transfers and the contact point for handling personal-information complaints.

7.7 How to exercise your rights

Send a request to [email protected]. We will verify your identity in a manner proportionate to the sensitivity of the request and respond within the timeframe required by applicable law (without undue delay and within a reasonable period under the PIPL; typically 30 days under the GDPR; 45 days under the CCPA, extendable once by 45 days). If we refuse a request, we will explain the reason and, where the PIPL applies, inform you of your right to file a complaint with the cyberspace administration or another competent authority, or to bring a lawsuit.

8. Children

8.1 As a matter of product policy, the Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16 without verifiable consent from a parent or legal guardian. (This 16-year threshold is a product/GDPR-Art.-8-aligned choice and is not the statutory line under the PIPL.)

8.2 Mainland China (PIPL Art. 31). Where we process the personal information of a minor under the age of 14, we obtain the consent of the minor’s parent or other guardian and process such information under a dedicated set of rules established for that purpose.

8.3 In other jurisdictions where the digital-consent age is lower than 16, the locally applicable age governs.

8.4 If you believe a child has provided us with personal information without the required parental or guardian consent, please contact [email protected] and we will take reasonable steps to delete it.

9. International Transfers and Cross-Border Provision

9.1 The Company is established in Mainland China, and its core account, authentication, and license infrastructure is located in Mainland China (Alibaba Cloud, East-China-1 / Hangzhou region). If you are located outside Mainland China, the personal information described in this Policy may therefore be transferred to and processed on servers in Mainland China; and, where we use service providers located in other regions, your personal information may also be processed there.

9.2 Cross-border provision out of Mainland China (PIPL Art. 38–39). Where we provide your personal information to a recipient outside Mainland China, we will do so only after meeting at least one of the conditions in PIPL Article 38 (a security assessment organized by the cyberspace administration; certification by a specialized body; or the standard contract formulated by the cyberspace administration), or where an applicable exemption applies. Before any such cross-border provision, we will (a) separately inform you of the overseas recipient’s identity and contact details, the purposes and means of processing, the categories of personal information, and how you may exercise your PIPL rights against the recipient, and (b) obtain your separate consent where the law requires it (PIPL Art. 39). At our early scale, where the cumulative volume of personal information provided abroad remains below the regulatory thresholds, an exemption may apply; we monitor these thresholds and will adopt a statutory mechanism when required.

9.3 EEA / UK transfers. Where we transfer personal information from the EEA or the UK to a country that the European Commission or the UK government has not deemed adequate (including Mainland China), we rely on the European Commission’s Standard Contractual Clauses (2021) or, for UK transfers, the UK International Data Transfer Agreement / Addendum, supplemented by a transfer impact assessment (TIA) where appropriate.

9.4 Other service providers. Where we use service providers located outside your jurisdiction, we put in place appropriate safeguards (such as Standard Contractual Clauses with additional measures) and continue to monitor the status of frameworks such as the EU-US Data Privacy Framework; the legal landscape in this area is evolving. (See “Residual Risk Notice — International Transfers” at the end of this Policy.)

9.5 Japan and South Korea. We provide notices and obtain consent as required by APPI and PIPA before transferring personal data of users in those countries outside their respective jurisdictions, and we describe the safeguards in place.

9.6 Payments. Your payment data is collected and processed by Paddle as Merchant of Record under its own privacy notice and its own cross-border transfer safeguards; that processing is independent of the Company.

9.7 You may request a copy of the safeguards used for transfers affecting you by writing to [email protected].

10. Retention

We retain personal information only as long as necessary to fulfill the purposes described in this Policy, including any legal, accounting, or reporting requirements.

Data category	Default retention
Account information	Until you delete your account, then up to 30 days for backups
License activation logs	2 years for fraud / abuse investigation
Connection / security logs (incl. IP)	90 days
Payment metadata	As required by applicable accounting and tax law (typically 5–7 years)
Support tickets	2 years after closure
Marketing consent records	Until withdrawn + a short audit window

We may extend retention where required by law, ongoing investigations, or to defend legal claims.

11. Security

We maintain administrative, technical, and physical safeguards reasonably designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These include encryption in transit, access controls, separation of environments, and incident response procedures.

If we become aware of a personal-information breach (leakage, tampering, or loss) that is likely to result in risk to your rights and freedoms, we will take remedial measures and notify the relevant authority and affected users in accordance with applicable law (e.g., PIPL Art. 57; GDPR Art. 33–34; CCPA / state breach-notification laws; APPI; PIPA).

12. Contact Points and Representatives

Personal information handler / Controller: 杭州万像循声科技有限公司 (Hangzhou Wanxiang Xunsheng Technology Co., Ltd. / HANG ZHOU WAN XIANG XUN SHENG KE JI YOU XIAN GONG SI) Registered office: [Hangzhou, Zhejiang Province, China — full address TBD]

Privacy contact / person responsible for personal information protection (PIPL Art. 52): [email protected]

Merchant of Record (payments): Paddle.com Market Limited — see https://www.paddle.com/legal/privacy

Data Protection Officer (DPO, if appointed): [DPO_NAME — TBD if appointed] Where a DPO is not legally required, the privacy contact above handles inquiries.

EU / EEA Representative (GDPR Art. 27): [DataRep_Address_TBD] UK Representative (UK GDPR Art. 27): [DataRep_Address_TBD]

Japan APPI inquiries: [Japan_Contact_TBD] South Korea personal-information protection officer: [Korea_PIPO_TBD]

13. Changes to This Policy

We will update this Policy from time to time. For material changes, we will provide reasonable advance notice by email and in-product notification. The “Last Updated” date at the top of this Policy reflects the most recent change.

14. Governing Law

This Policy is governed by the laws of the People’s Republic of China (Mainland), without prejudice to the mandatory data-protection rights you enjoy under the laws of your jurisdiction (including the GDPR, CCPA, APPI, and PIPA).

---

Residual Risk Notice — International Transfers (⚠️ DIY-High-Risk Item, for internal review)

This notice is for the SoundSeeker team’s internal awareness during draft review and is not part of the binding policy text published to users; it should be removed or relocated to an internal commentary document before publication.

Cross-border data-transfer rules for EEA → US transfers are in flux. The EU-US Data Privacy Framework adequacy decision (2023-07-10) has been the subject of ongoing litigation, and the European Commission’s Standard Contractual Clauses are themselves under review. Before relying publicly on any specific transfer mechanism, verify the current status via authoritative sources (eur-lex.europa.eu, edpb.europa.eu, ico.org.uk, cnpd.public.lu). Any decision to (i) localize EEA data, (ii) rely on SCCs+TIA, or (iii) not serve EEA users, is a strategic decision that the team should make with full knowledge of the residual risk and ideally with qualified counsel.

---

This is a draft for internal review. This document has been prepared as a DIY draft pursuant to the SoundSeeker legal-compliance methodology and is not legal advice. Before public release, qualified counsel should review (i) the PIPL cross-border-provision mechanism and separate-consent flow under Articles 38–39, and (ii) the Paddle Merchant-of-Record / reseller allocation of data-controller responsibilities — as well as the EEA/UK, US-California, Japan, and South Korea positions. Penalties under the PIPL can reach up to RMB 50 million or 5% of the prior year’s turnover for grave violations; penalties under the GDPR are tied to global turnover (up to 4%, capped at €20 million); penalties under the CCPA are per-violation and may be increased for violations involving minors.