Yunyou Brainwave Program Privacy Policy

Yunyou Brainwave Program (hereinafter referred to as "we" or "this program") deeply understands the importance of personal information to you. We will take corresponding security protection measures in accordance with legal requirements to protect your personal information security and controllability.

Before using the services of this program, please carefully read and fully understand this Privacy Policy (hereinafter referred to as "this Policy"). If you have any questions about this Policy, please contact our customer service for consultation.

I. How We Collect and Use Your Personal Information

Personal information refers to various information recorded in electronic or other forms that can identify a specific natural person alone or in combination with other information, or reflect the activities of a specific natural person.

1.1 Information We Collect

1.1.1 Information You Actively Provide

1.1.2 Information We Collect During Your Use of Services

1.1.3 Special Instructions for Avatar and Nickname

1.2 How We Use Collected Information

We will use the collected information for the following purposes:

1.2.1 Providing Core Service Functions

• Account Management: Identify your identity and record your login status
• Audio Playback Service: Provide brainwave audio playback functionality and record playback progress
• Permission Management: Verify your membership permissions and provide corresponding service content
• Personalized Settings: Save your audio parameter settings and personal preferences

1.2.2 Providing Paid Services

• Order Processing: Create orders, process payments, and grant benefits
• Order Inquiry: Display order records and purchase history to you
• Invoice Issuance: Issue purchase invoices according to your requirements

1.2.3 Improving and Optimizing Services

• Feature Optimization: Analyze user needs based on usage data and improve product features
• Performance Enhancement: Analyze performance data and optimize loading speed and stability
• Error Fixing: Collect error logs to locate and fix technical issues

1.2.4 Ensuring Service Security

• Security Protection: Identify and prevent fraud, abuse, and other illegal activities
• Account Protection: Detect abnormal logins and protect account security
• Dispute Resolution: Use as evidence when disputes occur

1.2.5 Data Statistical Analysis

• User Research: Understand user usage habits and improve product design
• Operational Analysis: Statistics on user activity, retention rate, and other operational indicators
• Conversion Analysis: Analyze payment conversion funnels and optimize purchase processes

1.2.6 Other Legitimate Purposes

• Fulfilling Legal Obligations: Cooperate with government supervision, judicial investigations, etc.
• Notification Push: Send service notifications and activity information to you (you can turn it off at any time)
• Customer Service: Respond to your inquiries, complaints, and suggestions

1.3 Exceptions to Consent

According to relevant laws and regulations, in the following circumstances, we may collect and use personal information without obtaining your explicit consent:

• Directly related to national security and defense security
• Directly related to public security, public health, and major public interests
• Directly related to criminal investigation, prosecution, trial, and execution of judgments
• For maintaining your or other individuals' major legitimate rights and interests such as life and property, but it is difficult to obtain the consent of the person
• The personal information collected is disclosed by you to the public
• Collecting personal information from legally disclosed information, such as legal news reports, government information disclosure, and other channels
• Necessary for signing and performing contracts according to your requirements
• Necessary for maintaining the safe and stable operation of the products or services provided, such as discovering and handling product or service failures
• Other circumstances stipulated by laws and regulations

II. How We Use Cookies and Similar Technologies

2.1 Use of Cookies

Cookies are small text files that are stored on your device when you visit a website or program. We use cookies and similar technologies to:

• Maintain your login status
• Remember your preference settings
• Understand your usage habits
• Provide personalized service experience

2.2 Local Storage

We use the local storage function (Storage) provided by WeChat program to save the following data:

• User Preferences: Audio parameter settings, personalized configuration
• Subscription Status: Membership benefit information, unlock records
• Usage Records: Daily usage duration, playback history
• Temporary Data: Session information, cached data

2.3 Anonymous Identifiers

We will generate an anonymous identifier (UUID) for your device to associate your usage data. This identifier does not contain any information that can identify your personal identity.

2.4 Your Choices

• You can clear the program's cache and data through WeChat's settings function
• You can clear local storage by deleting and re-adding the program
• Clearing data may cause your personal settings to be lost, but it will not affect purchased benefits

III. How We Share, Transfer, and Publicly Disclose Your Personal Information

We promise to maintain confidentiality obligations for your personal information and will not share, transfer, or publicly disclose your personal information with any third party, unless it meets the following circumstances:

3.1 Sharing

We may share your personal information in the following circumstances:

3.1.1 With Your Explicit Consent

After obtaining your explicit consent, we will share your personal information with other parties.

3.1.2 Sharing with Affiliated Companies

We may share your personal information with our affiliated companies, but only for the purposes necessary to provide services and subject to the purposes stated in this Policy.

3.1.3 Sharing with Authorized Partners

We may share information with the following types of authorized partners:

3.1.4 Based on Laws, Regulations, or Government Requirements

In the following circumstances, we may share your personal information in accordance with laws, regulations, or mandatory government requirements:

• Compliance with applicable laws, regulations, and other relevant provisions
• Compliance with court judgments, rulings, or other legal procedures
• Compliance with requirements of relevant government agencies or other legally authorized organizations
• Reasonably necessary to protect public interests, the personal and property safety of us or affiliated companies, you or other users or employees from harm

3.2 Transfer

We will not transfer your personal information to any company, organization, or individual, except in the following circumstances:

• With your prior explicit consent
• Enterprise merger, acquisition, or bankruptcy liquidation: If personal information transfer is involved, we will require the new company or organization holding your personal information to continue to be bound by this Policy, otherwise we will require that company or organization to re-seek your authorization and consent

3.3 Public Disclosure

We will not publicly disclose your personal information, except in the following circumstances:

• With your prior explicit consent
• Based on mandatory requirements of laws, regulations, legal procedures, litigation, or government authorities

3.4 Exceptions to Prior Authorization for Sharing, Transfer, and Public Disclosure

According to relevant laws and regulations, the following circumstances do not require prior authorization and consent for sharing, transferring, or publicly disclosing your personal information:

• Directly related to national security and defense security
• Directly related to public security, public health, and major public interests
• Directly related to criminal investigation, prosecution, trial, and execution of judgments
• For maintaining your or other individuals' major legitimate rights and interests such as life and property, but it is difficult to obtain the consent of the person
• Personal information you have disclosed to the public
• Collecting personal information from legally disclosed information, such as legal news reports, government information disclosure, and other channels

IV. How We Protect and Store Your Personal Information

4.1 Data Security Technical Measures

We attach great importance to personal information security and take the following security technical measures to protect your personal information:

4.1.1 Data Transmission Security

• Use HTTPS encryption protocol to transmit data
• Encrypt sensitive information during transmission
• Prevent data from being stolen or tampered with during transmission

4.1.2 Data Storage Security

• Encrypt stored sensitive information
• Deploy access control mechanisms to limit data access permissions
• Use security equipment such as firewalls and intrusion detection to protect servers

4.1.3 Data Access Control

• Implement strict data access permission management
• Only authorized personnel can access your personal information
• Log and audit access behaviors

4.1.4 Data Desensitization

• Desensitize data used for analysis
• Remove or blur information that can identify personal identity
• Ensure data analysis does not leak personal privacy

4.2 Data Security Management Measures

4.2.1 Security Management System

• Establish data security management systems and processes
• Clarify data security responsible persons and management responsibilities
• Conduct regular security training and assessment

4.2.2 Personnel Management

• Sign confidentiality agreements with employees who have access to personal information
• Strictly limit the scope of personnel who have access to personal information
• Hold accountable for violations of confidentiality obligations

4.2.3 Security Audit

• Regularly conduct security audits and risk assessments
• Timely discover and fix security vulnerabilities
• Continuously improve security protection measures

4.3 Data Retention Period

We only retain your personal information for the period necessary to provide services. The specific retention periods are as follows:

• Account Information: Continuously saved during your use of this program
• Order Information: Saved for at least 3 years as required by laws and regulations
• Usage Records: Saved for 180 days
• Log Information: Saved for 30 days

After the above period expires, we will delete or anonymize your personal information.

If we terminate services or operations, we will notify you at least 30 days in advance and delete or anonymize your personal information after service termination or operation cessation.

4.4 Data Security Incident Handling

Although we have taken the above security measures, please understand that due to technical limitations and various possible malicious means, it is impossible to guarantee 100% security of information in an internet environment.

If a personal information security incident unfortunately occurs, we will inform you in a timely manner in accordance with legal requirements:

• Basic information about the security incident and possible impacts
• Measures we have taken or will take to handle the incident
• Suggestions for you to prevent and reduce risks independently
• Remedial measures for you

We will promptly inform you of the relevant situation through email, letter, phone, push notification, and other methods. When it is difficult to inform each personal information subject individually, we will publish announcements in a reasonable and effective manner.

At the same time, we will also proactively report the handling of personal information security incidents to regulatory authorities as required.

V. How You Manage Your Personal Information

We attach great importance to your attention to personal information and do our best to protect your rights to access, correct, delete, and withdraw consent regarding your personal information, so that you have full ability to protect your privacy and security.

5.1 Access Your Personal Information

You have the right to access your personal information, except as otherwise provided by laws and regulations. You can access your personal information through the following methods:

• (1) Account Information: View your WeChat nickname and avatar within the program
• (2) Order Information: View your purchase records and order details on the "Member Center" page
• (3) Usage Records: View your usage duration on the homepage

If you cannot access through the above methods, you can contact us, and we will reply to your access request within 15 business days.

5.2 Correct Your Personal Information

When you find that the personal information we process about you is incorrect, you have the right to request us to make corrections or supplements. You can make corrections through the methods listed in "5.1 Access Your Personal Information" or submit a correction application by contacting customer service.

5.3 Delete Your Personal Information

In the following circumstances, you can request us to delete personal information:

• If our processing of personal information violates laws and regulations
• If we collect and use your personal information without obtaining your explicit consent
• If our processing of personal information seriously violates our agreement with you
• If you no longer use our products or services
• If we permanently no longer provide products or services to you

We will respond to your deletion request within 15 business days. After you delete information from our services, we may not immediately delete the corresponding information from the backup system, but we will delete this information when the backup is updated.

5.4 Change the Scope of Your Authorization and Consent

You can change or withdraw your authorization and consent through the following methods:

5.5 Account Cancellation

If you wish to cancel your account, you can do so through the following methods:

Cancellation Method: Contact customer service to apply for account cancellation

Cancellation Conditions:

• The account is in a safe state (no disputes, complaints, etc.)
• There are no unfinished orders or transactions in the account
• The account has been unbound from authorized login or binding relationships with other websites and applications

We will complete the review and processing within 15 business days after receiving your cancellation application.

5.6 Responding to Your Requests

To ensure security, we may need you to provide a written request or prove your identity in other ways. We will reply to your request within 15 business days after receiving your feedback and verifying your identity.

For your reasonable requests, we generally do not charge fees, but for multiple repeated requests that exceed reasonable limits, we will charge certain cost fees as appropriate.

In the following circumstances, as required by laws and regulations, we will not be able to respond to your requests:

• Directly related to national security and defense security
• Directly related to public security, public health, and major public interests
• Directly related to criminal investigation, prosecution, trial, and execution of judgments
• There is sufficient evidence that you have subjective malice or abuse of rights
• Responding to your request will cause serious damage to the legitimate rights and interests of you or other individuals or organizations
• Involving trade secrets

VI. Protection of Minors' Personal Information

We attach great importance to the protection of minors' personal information.

6.1 Notice for Minors

(1) If you are a minor under 18 years old, before using the services of this program, you should read this Policy accompanied by your parents or other guardians, and ensure that you have obtained the consent of your parents or other guardians for your use of our services and provision of information to us.

(2) If you are a child under 14 years old, we will not actively collect your personal information in principle. If collection is indeed necessary, we will obtain the explicit consent of your parents or other guardians in advance.

6.2 Notice for Guardians

(1) If you are a guardian of a minor, please pay attention to whether the minor under your guardianship is using our services after obtaining your authorization and consent. If you have questions about the personal information of the minor under your guardianship, please contact us through the contact methods listed in this Policy.

(2) We recommend that guardians:

• Guide minors to use this program correctly
• Pay attention to minors' usage duration and avoid excessive use
• Supervise minors' payment behaviors and avoid unauthorized consumption

6.3 Special Protection for Minors

We take special protection measures for minors' personal information:

• Minimize the collection of minors' personal information
• Strictly limit the scope of use of minors' personal information
• Without guardian consent, we will not share minors' personal information with third parties
• If we find that minors' personal information has been collected without guardian consent, we will delete it as soon as possible

VII. How This Policy Is Updated

In order to provide you with better services, this program and related services will be updated and changed from time to time, and we will revise this Policy accordingly.

7.1 Change Notification

When this Policy changes, we will notify you through the following methods:

• Notify in the form of announcements within the program
• Prompt in the form of pop-up windows within the program
• Push to you through WeChat service notifications

7.2 Change Effectiveness

After the Policy changes, if you continue to use our services, it means that you have fully read, understood, and accepted the modified Policy content.

7.3 Major Changes

If this Policy undergoes major changes, we will notify you in a more obvious way before the changes take effect and re-obtain your consent.

Major changes referred to in this Policy include but are not limited to:

• Major changes in our service model
• Changes in the main objects of personal information sharing, transfer, or public disclosure
• Major changes in your rights and methods of exercising them regarding personal information processing
• Changes in our contact methods and complaint channels
• When personal information security impact assessment reports indicate high risks

VIII. Scope of Application

8.1 Policy Scope of Application

This Policy applies to all services we provide to you through the Brainwave Meditation program.

8.2 Third-Party Services

This program may contain links to third-party products or services, including but not limited to services provided by third parties, plugins developed by third parties, etc.

These third-party social media or other services are operated by the relevant third parties. Your use of such third-party social media services or other services (including any personal information you provide to such third parties) is subject to the third party's own terms of service and personal information protection statement (not this Policy), and you need to carefully read their terms.

This Policy only applies to information we collect, store, use, share, and disclose, and does not apply to any services provided by third parties or third-party information usage rules.

IX. Dispute Resolution

9.1 Applicable Law

The conclusion, execution, interpretation, and dispute resolution of this Policy shall be governed by the laws of the People's Republic of China.

9.2 Dispute Resolution Method

If any dispute arises regarding the content of this Policy or its execution, both parties shall resolve it through friendly consultation; if consultation fails, either party may file a lawsuit with the people's court with jurisdiction in the place where the operator is located.

X. How to Contact Us

10.1 Contact Information

If you have any questions, opinions, or suggestions about this Privacy Policy, or if you encounter any personal information-related issues when using our services, you can contact us through the following methods:

10.2 Response Time

We will reply to your request as soon as possible (usually within 15 business days) after receiving your feedback.

10.3 Complaints and Reports

If you believe that our personal information processing behavior has damaged your legitimate rights and interests, you can file a complaint or report to regulatory authorities such as cyberspace administration, telecommunications, public security, and industry and commerce.

XI. Definitions and Interpretations

11.1 Personal Information

Personal information refers to various information recorded in electronic or other forms that can identify a specific natural person alone or in combination with other information, or reflect the activities of a specific natural person. Personal information involved in this Policy includes: basic information (WeChat nickname, avatar), identity information (OpenID, UnionID), network identity identification information (device information, log information), personal property information (order information, payment information), personal commonly used device information, personal internet records, etc.

11.2 Personal Sensitive Information

Personal sensitive information refers to personal information that, once leaked, illegally provided, or abused, may endanger personal and property safety, and is very likely to cause damage to personal reputation, physical and mental health, or discriminatory treatment. Personal sensitive information involved in this Policy includes: personal property information (order amount, payment information).

11.3 Deletion

Deletion refers to the act of removing personal information from systems involved in achieving daily business functions, making it remain in a state that cannot be retrieved or accessed.

11.4 Anonymization

Anonymization refers to the process of technical processing of personal information that makes the personal information subject unable to be identified, and the processed information cannot be restored.

11.5 Device

Device refers to equipment that can be used to access our services, such as smartphones with WeChat clients.

11.6 Unique Device Identifier

Unique device identifier refers to a string of characters encoded into the device by the device manufacturer, which can be used to uniquely identify the corresponding device (such as the IMEI number of a mobile phone). Unique device identifiers have various uses, including providing advertisements when cookies cannot be used (for example, in mobile applications).