Privacy Policy

1. Information and purposes

Accounts and authentication: registration, sign-in and account security involve your phone number, verification code validation information, account identifiers and password verification information. WeChat sign-in involves identity identifiers you authorize WeChat to provide and information needed for that login. Without required information, the corresponding registration or login cannot be completed.

Assets and tasks: when you choose to import, edit, generate or publish content, we process selected files, asset URLs, prompts, task parameters, generated results and task status. Cloud tasks send the relevant inputs to servers, object storage and model services needed for the task. Local assets not submitted to the cloud are distinct from assets submitted for tasks.

Browser extension capture and sync: when you actively capture an item, the extension stores selected product images, image URLs, titles, price text, product links, source URLs, platform and capture time locally, where available on the page, together with site preferences and sync status. Sync prioritizes a local interface to your desktop app. If the local app is unavailable, images and product information are delivered to the paired account's desktop app through our collection relay and private object storage. Staging a capture alone does not initiate a cloud AI task.

Browser extension pairing: the extension can connect automatically to the signed-in local desktop account or use a pairing code. Pairing and maintaining authorization involve account identifiers, display name, browser and operating system names, a separate extension authorization token and local connection identifiers. The extension does not share the desktop account's session cookies. Unlinking the account revokes the current extension authorization and disconnects Agent control; it does not delete previously synced images or past tasks.

Desktop Agent browser control: on first use, the extension explains data use and requests browser authorization. If you select and confirm “Remember this browser authorization”, the currently paired account’s Agent can automatically use current and future ordinary web tabs in this browser for later tasks and reconnections without repeated prompts. This choice is stored locally and bound to the current pairing. You can instead disable remembering and share selected tabs for this connection only; selecting none creates a dedicated tab. The Agent can use authorized tabs’ existing signed-in sessions to read content, take screenshots, click, fill forms, download task-related images or files, navigate authorized pages, create task tabs and access their popups. In one-time mode, dragging a tab into the Agent group grants additional access. Task-related page content, URLs, screenshots and interaction results may be sent to cloud AI services. “Disconnect” in the extension popup unlinks the account, stops further sync, clears the remembered browser choice and disconnects all control connections. “Disconnect this connection” retains remembered authorization. Unlinking, invalid authorization or a changed pairing prevents reuse of the old choice. The extension does not collect browsing history for advertising, data sales or unrelated profiling.

Orders and service records: paid features involve order numbers, purchased items, amounts, payment status, quotas and usage records to provide entitlements, check bills and resolve disputes. Payment providers process payment account information under their own rules.

Operations and security: necessary network addresses, application versions, device environments, access logs and error logs support service operation, troubleshooting and abuse prevention. If you submit feedback, we also process the contact information and problem details you provide.

TikTok authorization, after launch: only after you authorize through TikTok's official process, we will process account identifiers such as open_id and, when available, union_id, display name, avatar, access tokens and refresh tokens within approved permissions you grant. This identifies connected accounts, maintains authorization and enables the publishing services you request. We do not ask you to give yaholai your TikTok password.

TikTok video lists, after launch: only after you separately grant video.list, we will read that authorized account's public video identifiers, captions, descriptions, covers, posting times, durations and share links to display published videos in the desktop app. This permission does not read other accounts' private videos, follower lists, direct messages, store orders or transaction data.

TikTok publishing, after launch: we will process the selected video file, caption, visibility, interaction settings and commercial disclosures, retrieve creator permissions, and process publishing task identifiers and status to execute, display and troubleshoot uploads or posts you confirm. video.publish enables confirmed direct posts and video.upload enables confirmed draft uploads; these publishing permissions themselves do not read historical video lists. Refusing or withdrawing permissions affects the corresponding features, not unrelated features. New capabilities require separate notice and necessary authorization under applicable law.

2. Local permissions, sessions and third-party connections

The desktop application reads or writes files after you select assets, directories or download locations, and stores configuration, caches and login state locally. Connecting a store or third-party platform requires processing the authorization information necessary for that connection. Connect only accounts you are entitled to manage.

The website and application may use necessary cookies, local storage or similar technologies to maintain sessions and preferences. Clearing local data or signing out may invalidate that state. Independent pages of external websites, WeChat, payment providers and e-commerce platforms follow their own privacy rules.

Browser extension permissions: website access displays capture controls, reads selected product information and retrieves images. Tab and group permissions support site preferences and authorized Agent tab management. Debugger access performs authorized page reading and actions. Local storage and alarms retain preferences, authorization and pending sync tasks and check progress. A site's capture switch controls capture tools and does not authorize Agent control. You can restrict website access or uninstall the extension in your browser's extension manager; corresponding features may become unavailable. Agent control can be disconnected separately in the extension popup.

TikTok authorization is separate from yaholai registration and agreement to policies. You may refuse authorization or revoke it using TikTok's application permission controls. At launch we will explain how to disconnect within yaholai. Revoking authorization does not delete content already published on TikTok; manage that content through TikTok.

3. Providers, sharing and disclosure

For SMS verification, cloud storage, AI inference, payment or third-party publication you initiate, we provide necessary data to service providers and constrain their purposes and security obligations as applicable. Providers used for a task depend on your chosen feature and the current service configuration.

Recipients of extension data: local capture transfers go to your desktop app. Cloud relay transfers are processed by us and our contracted hosting and object storage providers, then delivered to the same paired account's desktop app. When you initiate an Agent task, relevant page information may also be processed by the AI model providers used for that task. Requests for pages or files are processed by the product website using the browser's existing session. Extension data is used only for requested capture and sync, authorized browser assistance, and necessary security and troubleshooting. We do not sell it or use it for advertising or unrelated purposes. Our use of information received through Chrome APIs complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.

Agreeing to this policy does not automatically make your non-public assets available for public display, sale or unrelated uses. New purposes, disclosure to independent controllers or matters requiring separate consent will receive additional notice and legally required consent.

Legally required disclosures, business transfers or mergers follow applicable conditions and procedures, including required notice and obligations on recipients.

Limits on TikTok data: data obtained through TikTok APIs is used only for the account connection and content publishing services you authorize. It is not sold or used for cross-context behavioral advertising, unrelated profiling or AI model training, and is not provided to AI inference services. Your own or authorized assets that you actively submit for cloud AI creation belong to a separately initiated creation task; that does not expand permitted purposes for TikTok API data.

TikTok publishing recipients, after launch: we will send TikTok the content and parameters needed for a task only after your express upload confirmation. Hosting, storage and technical operations providers supporting connection and publication may process data only as necessary for constrained purposes. Authorization tokens must not be provided to unrelated providers, advertising services or AI models. TikTok independently processes data on its platform under its own privacy rules.

4. Retention, security and international processing

Personal information is kept only as long as necessary for the stated purposes. Transaction, security and other records required by law follow the applicable requirements. We delete or anonymize information when deletion conditions are met. Backups that cannot be cleared immediately are restricted in use and handled during subsequent cleanup.

Extension retention: unsynced captures, preferences, authorization and sync records are stored in your browser. Queued images have local copies for delivery and retries; those copies are removed after receipt is confirmed. Cloud images awaiting receipt are valid for seven days. Once the desktop confirms receipt, relay images enter a cleanup cycle of approximately one day. Cleanup runs hourly and may be delayed by failures. Image cleanup also removes product details from the relay record; necessary delivery status records are retained for 30 days after cleanup for reconciliation. Desktop assets and Agent task records follow their own retention rules and are not automatically deleted with relay images.

We use access controls, authentication and transmission protections appropriate to the processing risks. No system can promise absolute security. If a personal information security incident occurs, we will take remedial measures and fulfill applicable notification and reporting obligations.

Features involving cross-border provision of personal information must disclose the recipients, purposes, categories of information and ways to exercise rights before transfer, and complete applicable legal procedures. General agreement to this policy does not replace separately required consent.

TikTok features are not currently available. Their hosting providers, storage locations and specific cleanup periods have not yet been determined. We will update this policy and disclose actual arrangements before enabling authorization. This description does not claim that storage locations have been determined or deletion workflows implemented.

TikTok retention rules, after launch: authorization tokens will be retained only as needed for a valid connection. After revocation, disconnection or token expiry, they will no longer be used to access the account, and unnecessary tokens and account details will be removed. Temporary upload files will be cleared after task completion, failure or cancellation when no longer needed for that task. Necessary task and security records will follow disclosed retention periods. Legally required records will be restricted to their statutory purposes, and backups awaiting cleanup will have restricted access and use. Specific periods and procedures will be disclosed before launch.

5. Access, correction, deletion and account closure

You may request access, copies, correction or completion of personal information, and where applicable deletion, withdrawal of consent or account closure. Use account and settings features already provided in the application. For matters without a self-service option, email bd@ling-swift.com with your account identifier and request. Do not send passwords, verification codes or authorization tokens.

To protect your account, we may require necessary identity verification and will respond promptly as required by law. Withdrawal does not affect processing already performed on the basis of consent. Withholding required information may prevent related services from continuing. After account closure or deletion, legally retained records are restricted to statutory purposes.

Deleting local files, uninstalling the application or signing out does not close your account or delete all server data. Save the assets, results and order records you need before requesting account closure.

Managing extension data and authorization: use “Disconnect” in the extension popup to stop further sync and browser assistance and unlink your account, delete unsynced items in the capture panel, and delete received assets in the desktop collection library. Clear local extension data through your browser's data management or uninstall controls. Unlinking does not automatically delete all local tasks, desktop assets or server records. Email the contact above to request deletion of server-side extension-associated data.

After TikTok features launch, you may request disconnection or deletion of TikTok-associated data through the email above, or revoke authorization in TikTok. Once a request is received and verified, we will stop related access and handle it under the deletion procedures disclosed at that time and applicable law. Disconnection alone does not delete your yaholai account or content already published on TikTok.

US users: depending on state privacy laws applicable to you and our service, you may have rights to information, access, correction, deletion, copies, opt-out of certain processing and appeal of request decisions. Exercise rights or appeal by emailing us. We will verify only necessary information, respond within applicable legal deadlines and explain any denial. We will not unlawfully discriminate against you for exercising rights. TikTok API data is not used for sale or cross-context behavioral advertising.

6. Minors' information

Our product is primarily for e-commerce operators and creators with appropriate legal capacity. Minors should use it under a guardian's guidance. Processing information about children under fourteen requires guardian consent and appropriate protections as required by law.

Do not upload minors' likenesses, voices or other personal information without lawful authorization. Guardians who discover improper processing may request investigation and deletion.

7. Policy updates

Updates will carry a revision date. Material changes to purposes, methods, information categories or your rights will receive appropriate notice and renewed consent where required by law.

Chinese and English versions are intended to express the same processing rules and rights. Contact the email on this page with differences in meaning or privacy concerns so we can clarify and correct them.