Privacy policy
This policy explains what the mxly.plus site collects, why, how long it is kept, and how to have it deleted. Every statement below corresponds to a specific behaviour on the site rather than a generic disclaimer.
1. Data controller and scope
Data controller: Shenzhen Danfeng Mali Intelligent Technology Co., Ltd., Unified Social Credit Code 914403003594292928, incorporated in Shenzhen, Guangdong, in December 2015.
This policy applies to the corporate site at mxly.plus only, including its English section under /en. The four product lines live on their own subdomains and inside a WeChat mini program — Jiutian Xuanhua, an AIGC short-drama creation mini program, the MuXue AI customer acquisition system (www.mxly.plus), the StarHub international settlement system (starhub.mxly.plus) and the agent-software automation platform (xq.mxly.plus). Their functionality and data practices are governed by the policies published on those sites, which this policy does not cover.
This site has no user accounts, no online purchase or payment, no advertising, and loads no third-party analytics, social plugins or external CDN.
2. What we collect
(a) Information you enter. Collected only when you submit the contact form: your name, company or team name, phone number or email address, and a description of your requirement. The phone or email is used to reply; the description is used to judge whether your situation fits one of our product lines. You may optionally indicate a product line and the page you came from.
(b) Technical information generated automatically for security and troubleshooting. Each submission records: a salted SHA-256 hash of the originating IP address truncated to its first 16 hexadecimal characters (the raw IP is never written to the database or the logs), the browser User-Agent string (truncated to 300 characters), and the submission time. The hash is irreversible — we cannot recover your IP from it — and its only purpose is to detect repeated submissions from the same source.
(c) Page-view analytics. We record structured events: the event name (page view, language switch, button click, form started, FAQ expanded, and similar), page path, interface language, device type, referring domain and timestamp. Analytics never record text you type into any field. The server enforces a strip list covering name, company, contact and message, so even a front-end bug that sends them results in the data being discarded and logged.
(d) The form contains an input labelled "website". It is a honeypot used to identify automated scripts; genuine visitors never need to fill it, and the page hides it from both keyboard navigation and screen readers. If it is filled, the submission is treated as machine-generated: we return the same confirmation a human would see, but nothing is written to the database and nobody is notified.
We do not collect sensitive personal information such as identity card numbers, biometrics, bank accounts, precise location, contacts, photos or microphone input. We do not knowingly collect personal information from children under 14.
3. Legal basis for processing
Contact form: your consent. Submitting the form indicates that you agree to our processing those details in order to reply to your enquiry.
Security and diagnostic data: necessary to keep the service secure and stable. This data blocks automated abuse and helps us diagnose failed submissions; without it the site cannot reliably serve anyone.
Analytics: your consent. It covers only the structured fields listed above and never any content you typed.
You may refuse or withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it. See section 8 for how to exercise this.
4. How we use it
Contact details are used for this enquiry only: to determine which product line fits, to respond to you, and, with your agreement, to arrange a follow-up conversation. We do not use them for advertising, profiling, automated decision-making or any purpose unrelated to your enquiry.
Technical data is used solely for anti-abuse and fault diagnosis. Analytics are used to judge whether page content is actually being read, so we can improve how information is organised.
We do not sell your personal information and do not provide it to third parties for profit.
5. Where and how long we keep it
All data is stored on cloud servers located in mainland China (Tencent Cloud, Shanghai region). No cross-border transfer takes place.
Contact form submissions are kept for 24 months from the date of submission, after which they are deleted in batches. You may request earlier deletion at any point within that period; we will not refuse on the grounds of business need.
Analytics events are kept for 180 days. Rate-limit counters exist only for three windows — one minute, one hour and one day — and expire automatically when each window closes.
Where law mandates a different retention period, that period prevails. Once retention is no longer required, we delete or anonymise the data.
6. Processors, sharing and cross-border transfer
We engage Tencent Cloud (Tencent Cloud Computing (Beijing) Co., Ltd.) to provide cloud compute, cloud database and content-delivery infrastructure. As our processor, Tencent Cloud acts only on our instructions, may not use the data for purposes beyond those in this policy, and is bound by the service agreement between us.
We disclose personal information to third parties only: (a) with your separate consent; (b) where required by law; or (c) to competent authorities such as judicial organs or the Cyberspace Administration, acting through lawful procedures.
This site loads no third-party advertising networks, analytics tools or social login, and no scripts, fonts or images from external domains. As a result there is no disclosure of data to third parties for advertising purposes.
We do not transfer your personal information outside mainland China. Should a future business need require it, we would follow Chapter III of the Personal Information Protection Law — notice, separate consent, and a security assessment or standard contractual terms — and update this policy beforehand.
8. Your rights
Within the scope of the Personal Information Protection Law, you have the following rights, each with a channel you can actually use:
Access and portability of a copy: you may ask us to confirm whether we process your personal information and to provide a copy.
Rectification: you may ask us to correct or complete information that is inaccurate or incomplete.
Erasure: you may ask us to delete your information where the purpose has been fulfilled, where you have withdrawn consent, or where we have processed it in breach of law or agreement.
Withdrawal of consent: you may withdraw consent for the contact form and for analytics at any time, without affecting processing already carried out.
Data portability: you may ask us to transfer your personal information to another controller you designate; where the conditions set by the Cyberspace Administration are met, we will provide a means of transfer.
Explanation: you may ask us to explain the rules under which we process your personal information.
How to exercise: submit a note through the contact page stating the right you wish to exercise and a contact address we can verify against, or simply reply to our earlier confirmation. To stop someone else from acting on your behalf, we may need to verify your identity first. We respond within 15 working days of receiving a request and will not refuse without justified cause.
If you decline to provide the required form fields, we cannot judge whether your situation fits and therefore cannot reply to your enquiry. That is the only consequence — it does not restrict your access to any content on this site.
9. How we protect it
In transit: HTTPS is enforced site-wide; pages and APIs are never served over plain HTTP.
At the edge: the server performs field-level length and format validation, caps request body size, applies source-based rate limits across one-minute, one-hour and one-day windows, and uses a honeypot plus page-dwell timing to block automated submissions.
At rest: database credentials exist only in server-side environment variables and are never sent to the browser. IP addresses are stored as salted hashes, never in plaintext, and analytics enforce a strip list for names and contact details.
Access: only staff who need to handle your enquiry can reach the submitted data, and access is logged.
We have designated a person responsible for personal information protection, whose duties cover enforcement of this policy, internal training and incident response.
10. Security incidents
If personal information is, or may have been, leaked, tampered with or lost, we activate our incident process immediately: establish the cause, contain the scope, and assess the likely harm.
Under Article 57 of the Personal Information Protection Law we take remedial action at once and notify both the authority responsible for personal information protection and the affected individuals. The notification states what happened, the likely impact, the remedies we have applied, the steps you can take to reduce harm, and how to reach us.
Where individual notification is impractical, we publish a warning on this site. We do not conceal or delay notification for reputational reasons.
11. Minors
This site is aimed at business customers — operators or their representatives with full civil capacity — and is not offered to minors.
We do not knowingly collect personal information from children under 14. If we discover such collection, we delete it promptly. If you are a parent or guardian and find that a minor has submitted information to us, please contact us through the channel in section 13 and we will delete it.
12. Changes to this policy
When we update this policy we revise the effective date at the top of this page. If the change materially affects the purposes, methods, categories of information or your rights, we will draw attention to it on the home page and, where necessary, seek your consent again.
The revised policy applies from its effective date and does not retroactively govern processing already completed. If you do not accept a change, please stop submitting the form and you may ask us to delete information you previously submitted.
13. Contact and complaints
Data controller: Shenzhen Danfeng Mali Intelligent Technology Co., Ltd. Unified Social Credit Code: 914403003594292928. Registered in Shenzhen, Guangdong.
How to reach us: business email ai@mxly.plus, or WeCom (scan the card on the contact page); office address: Floor 1, Building 5, Liantang Jintian Industrial Zone, No. 128 Aoxia Village, Luohu District, Shenzhen, Guangdong, China. You may also submit a request through the contact page on this site. We respond within 15 working days.
If you believe our processing has infringed your rights, please raise it with us first. If you receive no reply, or are dissatisfied with it, you may complain to the Cyberspace Administration, telecommunications, public security or market regulation authorities, each of which has responsibilities for personal information protection.
In the event of any discrepancy between language versions, the Chinese version of this policy prevails.