Privacy Policy
PoemBridge is a bilingual Chinese-poetry learning site for readers in the United States, the European Union and elsewhere. This policy explains what we do with your personal data, in plain language.
1. Who we are & how to contact us
PoemBridge is operated by Kunming Shijie Liuxing Technology Co., Ltd. (昆明视界流形科技有限公司), Kunming, Yunnan, P.R. China. For privacy questions, data-subject requests, or to reach our data protection contact: 1634185520@qq.com.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Email address, optional display name, password stored only as a bcrypt one-way hash. We do not collect phone numbers and do not offer SMS sign-in. | You, at registration |
| Learning data | Saved/favourite poems, recitation activity | Your use of the site |
| Technical & log data | IP-derived coarse region, browser/user agent, pages requested, timestamps | Automatically, for security and operations |
| Verification data | Short-lived email-verification, password-reset and one-time codes | Generated by us |
| Billing data | Subscription status and tier in our database; card and billing details are collected and held by our payment provider, not by us | Our Merchant of Record (see §6) |
We do not collect precise geolocation, contacts, biometric data, or advertising identifiers, and we do not build behavioural advertising profiles.
3. Why we may process it (legal bases)
- Performance of a contract — creating your account, saving favourites, delivering a subscription you purchased (GDPR Art. 6(1)(b)).
- Legitimate interests — keeping the service secure, preventing abuse of verification codes, debugging, and producing aggregate service statistics (Art. 6(1)(f)). We limit this data and do not use it to make decisions about you.
- Legal obligation — retaining records required by tax/accounting rules, and responding to lawful requests (Art. 6(1)(c)).
- Consent — for any non-essential cookies or optional marketing emails, if introduced. Withdrawable at any time (Art. 6(1)(a)).
4. How long we keep it
- Account and learning data: until you delete your account, after which it is removed from the active database within 30 days.
- Verification / reset tokens: single-use, expiring within minutes to hours.
- Server access logs: up to 365 days, then deleted or irreversibly aggregated.
- Billing records: retained for the period required by applicable tax law.
- Backups: overwritten on a rolling cycle; deleted data may persist in backups until that cycle completes.
You can delete your account at any time from your account area, or by writing to us. Deletion removes your account, favourites and tokens; we retain only what law requires.
5. Cookies & analytics
We use a single strictly necessary httpOnly session cookie to keep you signed in. It is not used for tracking or advertising. We use cookieless, aggregate site analytics that do not set identifiers on your device. Details are in our Cookie Policy. If we ever add non-essential cookies, we will ask for your consent before setting them.
6. Processors & international transfers
We share data only with providers needed to run the service, under data-processing agreements:
- Hosting / CDN — static delivery and edge caching.
- Application & database hosting — account and learning data.
- Transactional email — verification and password-reset messages.
- Payment / Merchant of Record — handles checkout, card data, invoicing, VAT/sales tax and refunds, and is the seller of record for paid plans.
Our operator is based in China and our infrastructure may be located in the US/EU. China does not benefit from an EU adequacy decision. For transfers of personal data out of the EEA/UK we rely on Standard Contractual Clauses together with a transfer impact assessment, and on the EU–US Data Privacy Framework where the recipient is certified. You may request a copy of the relevant safeguards by email.
7. Your rights
If you are in the EU/EEA or UK, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests; you may also lodge a complaint with your local supervisory authority. Where processing relies on consent, you may withdraw it at any time.
If you are a California resident (CCPA/CPRA), you may request to know, access, correct or delete your personal information, and opt out of sale or sharing for cross-context behavioural advertising. We do not sell or share personal information as those terms are defined, and we do not use sensitive personal information to infer characteristics. We will not discriminate against you for exercising a right.
To exercise any right, email us from the address associated with your account. We respond within one month (EU/UK) or 45 days (California), and may need to verify your identity first.
8. Children
PoemBridge is a general-audience educational site and is not directed to children under 16 in the EU/UK or under 13 in the United States (COPPA). We do not knowingly collect personal data from children in those age groups. If you believe a child has provided data, contact us and we will delete it.
9. Security
Passwords are stored as bcrypt hashes; sessions use short-lived httpOnly, Secure cookies; verification and reset tokens are single-use and time-limited; administrative and profile actions are protected against cross-site request forgery; all traffic is served over HTTPS. No system is perfectly secure, but we apply reasonable technical and organisational measures and will notify affected users and regulators of a breach where the law requires.
10. Changes to this policy
We may update this policy as the service or law changes. We will post the new version here with a revised "Last updated" date and, for material changes, give prominent notice before they take effect.