隐私政策

xhswriter.ai 由 StaffOS Sdn. Bhd.(公司注册号 202601021856 (1683953-V),以下称「我们」)运营, 是一个让商家收集真实顾客分享、并用 AI 生成社交媒体帖子草稿的平台。

当你参加某个活动时,举办该活动的商家决定收集你资料的目的与方式,在马来西亚 《2010 年个人资料保护法》(PDPA)下是「资料使用者」(data user / 控制者)。 我们作为该商家的「资料处理者」(data processor),仅按商家指示及本政策所述的有限平台目的 处理你的资料。涉及行使你的权利或删除资料时,你可以联系商家,也可以直接联系我们协助。

当你参加活动时,我们会收集:

• 手机号码与姓名 — 用于识别参加者、避免重复参加、活动跟进及联系中奖者。
• 电邮地址(如该活动有收集) — 用于奖品/中奖通知。
• 问卷答案(文字、选项、评分等)以及你就「是否同意商家推荐语」所作的选择。
• 你上传的照片 / 视频 — 用于 AI 审核及生成你的帖子。
• 与 AI 的补充问答内容(如有),以及为你生成的帖子内容(标题、正文、标签、封面)。
• 你提交的小红书 / Lemon8 帖子链接,以及抽奖/奖品发放的记录(资格、中奖、兑换状态)。
• 提交的时间戳等技术记录。

我们不会收集或保存你的设备型号、浏览器等画像资料。你的 IP 地址仅在当下用于限制恶意 重复请求,不会被保存。你选择的语言与未提交的草稿只存在你自己的浏览器里,不会上传到我们服务器。

我们处理上述资料,是为了:让你参加你主动选择参加的活动、为你生成帖子草稿、把你纳入抽奖 或发放奖品、让商家联系中奖者,以及防止重复或滥用参加。法律依据是你的同意,以及为履行你 所要求的活动参与所必需。

生成帖子时,我们会把你的问卷答案、补充问答及上传图片的内容发送给我们的AI 服务提供商用于内容审核与生成。我们不会把你的手机号码或姓名发给 AI。

• 我们自身不会用你的资料训练或微调任何 AI 模型。我们 AI 服务提供商的服务条款亦声明:通过其 API 提交的内容不会用于训练其模型;我们也不会在生成草稿之外长期保存发给 AI 的提示内容。若该提供商上述政策日后变更,我们会通知并提供删除选项。
• 图片审核是自动化的,属尽力而为,并非绝对保证 — 它可能漏判,也不构成对内容合规的担保。被判定违规的上传图片会被拒绝且不予保存。若审核服务失败或暂不可用,上传内容会默认放行(而非拦截);因此你与商家须在发布前自行检查内容。
• 我们仅在内部评测中使用另一家 AI 供应商的模型,绝不把你通过本服务提交的真实资料发送给该供应商。

我们会在以下情况共享你的资料:

• 与你所参加活动的商家 — 这是参加活动的核心目的(商家凭此联系你、发奖、做活动统计)。
• 与下列代我们处理资料的服务商(我们已要求其按合约保护资料):

你提供的电邮(如有)仅用于该活动相关通知,不会发送给上述邮件发送服务商(该服务商仅用于商家账户的验证/重置邮件)。

此外,为核实你提交的帖子是否真实存在,我们的服务器会读取你自己提供的那条帖子链接; 我们不会主动把你的资料推送给小红书 / Lemon8。在法律要求或为保护权利时,我们也可能依法披露资料。我们不出售你的个人资料,也不投放广告或追踪类 Cookie。

我们的应用、数据库与文件存储位于新加坡;部分处理在美国进行(由我们的 AI 服务提供商)。 这意味着你的资料会被传输到马来西亚境外。继续参加活动即表示你同意这种跨境传输; 我们会采取合理措施,确保接收方提供与本政策相当的保护水平。这些跨境处理受合约性资料保护条款约束, 要求接收方达到与 PDPA 相当的标准,并辅以传输加密(TLS)与访问控制。

• 在活动进行期间,以及商家为该活动合理需要的期间内保留。
• 被审核拒绝的图片不会保存;无任何记录引用的孤立上传文件会被定期清理。
• 法律要求保留的记录(如与款项相关的记录)会按马来西亚税务法律最长保留 7 年。
• 你与 AI 的补充问答仅存于该帖记录中,仅用于生成你的帖子,帖子删除时一并删除,不另行存档,也不向商家展示原始对话。
• 收到经核实的删除请求后,我们会在不无故拖延的情况下处理(通常在 30 天内),但受上述法律保留义务限制。

在适用法律下,你有权:

• 查阅我们持有你的哪些个人资料;
• 更正不准确的资料;
• 撤回同意,或要求限制 / 停止处理;
• 向我们或大马个人资料保护局(JPDP)投诉。

行使方式:联系举办活动的商家,或电邮 hello@xhswriter.ai。我们会在 PDPA 规定的 21 天内 回应查阅请求。请注意:撤回同意可能导致你无法继续参加该活动或领取奖品。

我们以传输加密(TLS)、访问控制、敏感字段隔离等措施保护你的资料。但没有任何系统能保证 100% 安全; 我们无法对此作绝对担保。

本服务面向 18 岁及以上人士。未满 18 岁者仅可在父母或监护人同意下参加。我们不会在知情下收集 儿童的个人资料;如你认为我们误收了未成年人资料,请联系我们删除。

我们只使用维持基本功能所必需的 Cookie(会话与 CSRF 防护)。没有 Google Analytics、 Meta Pixel、Hotjar 或任何广告/追踪 Cookie。

我们可能不时更新本政策,并会更新页首的「生效 / 最近更新」日期;重大变更我们会在本页醒目标示。

如对你的个人资料有任何疑问或想行使权利:

你也可以通过 联系客服 联系我们。

本文件以中英文提供,中文仅为方便阅读。如中英文版本有任何冲突,以英文版本为准。

xhswriter.ai is operated by StaffOS Sdn. Bhd. (Company Reg. No. 202601021856 (1683953-V), “we”, “us”), a platform that lets merchants collect genuine customer experiences and generate AI-assisted social-media post drafts.

When you join a campaign, the merchant running that campaign determines the purposes and means of collecting your data and is the “data user” (controller) under Malaysia’s Personal Data Protection Act 2010 (“PDPA”). We act as that merchant’s data processor, handling your data only on the merchant’s instructions and for the limited platform purposes described here. To exercise your rights or request deletion, you may contact the merchant, or contact us and we will assist.

When you take part in a campaign, we collect:

• Your phone number and name — to identify entrants, prevent duplicate entries, follow up, and contact winners.
• Your email address (where the campaign collects it) — for prize / winner notifications.
• Your form answers (text, choices, ratings) and your choice on whether to allow the merchant’s recommendation wording.
• The photos / videos you upload — for AI moderation and to generate your post.
• Any follow-up Q&A with the AI, and the post content generated for you (title, body, hashtags, cover).
• The Xiaohongshu / Lemon8 post link you submit, and lottery / reward records (eligibility, winnings, redemption status).
• Timestamps and similar technical records of your submission.

We do not collect or store your device model, browser, or similar profiling data. Your IP address is used only momentarily to rate-limit abusive requests and is not stored. Your chosen language and any unsubmitted draft stay in your own browser and are not uploaded to our servers.

We process this data to: let you join a campaign you chose to enter, generate your post draft, enter you into a lottery or issue a reward, allow the merchant to contact winners, and prevent duplicate or abusive entries. Our legal basis is your consent and necessity for the campaign participation you requested.

To generate your post, we send your form answers, follow-up Q&A, and the content of your uploaded images to our AI provider for moderation and generation. We do not send your phone number or name to the AI.

• We do not use your data to train or fine-tune any AI model of our own. Our AI provider’s terms also state that content submitted through its API is not used to train its models; we do not retain the prompts sent to the AI beyond the resulting draft. If that provider’s policy changes, we will notify you and offer deletion.
• Image moderation is automated and best-effort, not a guarantee — it may miss content and is not a warranty of compliance. Images flagged as violating are rejected and not stored. If the moderation service fails or is temporarily unavailable, uploads are allowed by default (not blocked); you and the merchant must review all content before publishing.
• We use a separate AI vendor only for internal evaluation and never send your live submissions to it.

We share your data:

• With the merchant whose campaign you joined — this is the core purpose of taking part (the merchant uses it to contact you, award prizes, and analyse the campaign).
• With the sub-processors below, who process data on our behalf under contractual protections:

Any email you provide (if collected) is used only for notifications about that campaign and is not sent to our email service provider (which is used only for merchant account verification / reset emails).

To verify that your submitted post genuinely exists, our servers fetch the post link you yourself provide; we do not proactively push your data to Xiaohongshu / Lemon8. We may also disclose data where required by law or to protect rights. We do not sell your personal data, and we serve no advertising or tracking cookies.

Our application, database, and file storage are located in Singapore, and some processing takes place in the United States (by our AI provider). This means your data is transferred outside Malaysia. By taking part, you consent to this cross-border transfer; we take reasonable steps to ensure recipients provide a comparable level of protection. These cross-border processes are subject to contractual data-protection terms requiring standards comparable to the PDPA, together with encryption in transit (TLS) and access controls.

• For the duration of the campaign and for as long as the merchant reasonably needs it for that campaign.
• Images rejected by moderation are not stored; orphaned uploads with no record reference are purged regularly.
• Records we must keep by law (such as payment-related records) are retained for up to 7 years under Malaysian tax law.
• Your follow-up Q&A with the AI is stored only within the post record, used solely to generate your post, deleted when the post is deleted, not separately archived, and not shown raw to the merchant.
• On a verified deletion request, we act without undue delay (normally within 30 days), subject to the legal retention above.

Subject to applicable law, you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• withdraw consent, or ask us to limit / stop processing;
• complain to us or to the Department of Personal Data Protection (JPDP).

To exercise these, contact the merchant who ran the campaign, or email hello@xhswriter.ai. We respond to access requests within the 21 days set by the PDPA. Note that withdrawing consent may mean you can no longer continue the campaign or claim a prize.

We protect your data with encryption in transit (TLS), access controls, and isolation of sensitive fields. However, no system is 100% secure, and we cannot give an absolute guarantee.

The Service is intended for people aged 18 and over. Anyone under 18 may take part only with the consent of a parent or guardian. We do not knowingly collect personal data from children; if you believe we have, please contact us to have it removed.

We use only cookies strictly necessary for basic functionality (session and CSRF protection). There is no Google Analytics, Meta Pixel, Hotjar, or any advertising / tracking cookie.

We may update this policy from time to time and will update the “Effective / last updated” date at the top; we will highlight material changes on this page.

For any questions about your personal data, or to exercise your rights:

You may also reach us via WhatsApp.

This document is provided in Chinese and English; the Chinese text is for convenience only. In the event of any conflict, the English version prevails.