Privacy Policy

Who processes your information

Controller: Keguihua. Email: [email protected]. Address: Sole proprietor, no registered company address. Please contact us by email; we handle everything through email.

The website and your records run on the same server in New Jersey, United States. The provider is Vultr. The database is only reachable from that machine, not from the public internet.

The law that applies follows where you are, not where the database is. In China: the Personal Information Protection Law. In the EEA, UK or Switzerland: GDPR and the local rules that sit next to it.

Legal basis (GDPR)

If GDPR applies to you, we rely on these bases:

• Contract (Art. 6(1)(b)): creating your account, keeping you signed in, building the ZIP you asked for, processing your purchase and delivering the download.
• Consent (Art. 6(1)(a)): for registered users in China, the separate consent for storage in the United States. You can withdraw consent. That does not unwind processing that was already lawful.
• Legitimate interests (Art. 6(1)(f)): keeping payment notifications to verify payments and handle disputes, stopping abuse with short-lived request limits, keeping a record of who changed what. You can object.
• Legal obligation (Art. 6(1)(c)): keeping order records where accounting or tax law requires it.

What we collect

Only what we actually take and keep today.

Registered users

• Account: email, whether it is verified, display name, role, status, timestamps.
• Sign-in: we do not keep the password as you typed it. We keep a session token, expiry, and the IP address and browser string recorded when you sign in.
• One-time links for email verification, password reset, and email change.
• What you type: project name, original idea, target user, whether you plan to charge, clarified requirements, generated config.
• Generation jobs: who started them, success or failure, error type. The idea text is not stored on those job records.
• Export ZIP files and a checksum.
• Audit log: who did what. Creating a project records the idea's length, not the text.

Buying without an account

• What you fill in before paying: the idea you typed, the template you chose, and your answers. Your browser only holds a signed ID; the content is in our database.
• Payment email, Creem order ID, payment status and time: after you complete payment on Creem's page, Creem notifies us.
• The raw payment notification from Creem, which includes the payment email, order and customer identifiers. We store it as received to verify the payment and handle refunds.
• The order: which template, a snapshot of your requirements, the download link, download count, the ZIP.

What we never receive: card numbers, payment account details, billing address. You enter those on Creem's payment page and Creem processes them; they do not pass through our server.

Why we collect it

• Email and password: to register, sign in, and recover the account.
• IP and browser: to keep the session and check disputed sign-ins.
• Ideas and answers: to build a project pack that fits your business.
• Payment email and order: to confirm you paid, send you the download link, let you recover the download by email, and handle refunds.
• Raw payment notifications: to verify payments are genuine and handle duplicates and refund disputes.
• Audit log: a trail of actions. Anything that looks like a secret is redacted.

We do not buy mailing lists and we do not run an analytics script. Public marketing pages load the Google AdSense advertising script; Google and its advertising partners may process advertising requests, device information, and page-visit information under their own policies.

Google Privacy Policy: https://policies.google.com/privacy. The EazyOPC operator's own Google AdSense account handles the account, revenue, and payment details; this website does not collect the advertising revenue for customers.

How long we keep it

• Registered accounts, projects, requirements: until you delete the account, or we close it under the terms.
• Sessions: 7 days by default, refreshed while you keep using the site.
• Verification and reset links: they expire.
• What you fill in before buying without an account: expires after 7 days and is then cleared.
• Order records and raw payment notifications: currently kept long-term, with no automatic deletion. We use them to recover downloads, handle refunds and keep accounts. You can email us to ask for deletion; we will tell you which parts we must keep for accounting.
• Order download links: expire after 7 days; you can recover them with your payment email.
• Audit rows: stay after you delete the account, with the actor cleared and idea text wiped.
• Database backups: once a day, on the same server, kept for 14 days. After deletion, a backup may still hold your data for up to 14 days.

Who can see it

• You: registered users via project pages and Settings; buyers without an account via the order link.
• Platform admins: email, orders, and whether generation jobs failed.
• Other customers: cannot see your email, projects or orders.

Overseas recipients and transfers outside the EU

Each recipient below is an overseas recipient for users in China, and each one outside the EEA/UK is a transfer outside the EEA/UK for users in Europe.

Registered users in China: sign-up asks for two consents separately and keeps a record — one for the terms and privacy policy, and a separate consent for transferring personal information abroad. They are not bundled in one tick box.

Buying without an account: the purchase flow does not ask for a separate consent to transfer data abroad. After you pay on Creem's page, your payment email and order details are stored on the US server below. If you do not accept that, please do not buy this way; if you already bought, email [email protected] to ask for deletion.

Our relationship with these recipients is governed by their published terms of service and data processing terms. We have not separately signed the Standard Contract for Outbound Cross-Border Transfer of Personal Information issued by the Cyberspace Administration of China.

Your rights

• Access and copy: registered users use “Export my data” in Settings; buyers without an account email us with the payment email.
• Rectify: change your name in Settings; an email change waits until you click the link sent to the new address.
• Erase / delete your account: Settings, with your password. It takes effect at once. Account, sessions, projects, versions, jobs and export packs are deleted. Audit rows remain with the actor cleared.
• Delete order information: email [email protected] with your payment email. We will tell you which parts we must keep for accounting.
• Withdraw consent: email [email protected] and say which processing you want stopped. Features that need it will stop. We cannot pull back what a vendor already received.
• Object / restrict (GDPR): email us. We will tell you whether we still have a ground to continue.

If you withdraw the separate consent to store data in the United States, the product cannot keep serving you — the website and your records are in the United States and there is no copy in China. We will export and/or delete your data.

The overseas recipients do not handle your requests directly; we do.

Cookie

• Sign-in: better-auth.session_token (with an __Secure- prefix on HTTPS). HttpOnly, SameSite=lax, Secure on HTTPS. Block it and you sign in every time.
• Buying without an account: eazyopc_draft. It holds only a signed ID, not what you typed. HttpOnly, Secure, SameSite=lax, expires after 7 days.

Google AdSense may use Cookies or similar technologies to serve and measure advertising; see Google's policy and your browser/consent settings. We do not set our own analytics Cookie. To slow down repeated requests, the server briefly remembers your IP; a restart clears it.

Children

This website is for adults who can buy a server and run the project themselves. In China: under 14 needs a guardian; we do not knowingly collect children's data and delete it if we learn it belongs to a child. In the EU/UK the digital-consent age is 16, or 13–16 where a member state set a lower age — we follow that.

Changes

Changes are made on this page and the effective date at the top is updated. A new overseas recipient or a new purpose will be notified, or consent sought, as the law requires.

Complaints

Write to us first: [email protected].

In China you may also complain to the provincial cyberspace administration where you are.

If GDPR applies, you have the right to lodge a complaint with your supervisory authority — the data protection authority of the EU/EEA country where you live, work, or where the issue happened (and the UK ICO if you are in the UK). A list of EEA authorities is on the European Data Protection Board site.