1. Introduction
This Privacy Notice explains how HuoPuo, LLC ("HuoPuo," "we," "our," or "us") may collect, use, disclose, retain, and protect personal data in connection with HuoPuo software, applications, modules, client applications, protected runtime environments, support, implementation, license administration, security operations, websites, payment administration, customer communications, HuoPuo-operated chat or messaging features, and related services.
This Privacy Notice should be read together with the applicable HuoPuo End User License Agreement ("EULA"), Order, Data Processing Addendum ("DPA"), support terms, security documentation, Cookie Policy, Subprocessor List, Payment Data Handling Statement, and any other written agreement that applies to the relevant product, service, deployment, or transaction.
This Privacy Notice does not create product functionality, hosting commitments, support commitments, security warranties, certifications, audit results, data-residency commitments, service levels, or compliance guarantees that are not expressly stated in an applicable written agreement.
2. Scope
This Privacy Notice applies to personal data that HuoPuo processes in connection with:
▪HuoPuo websites, legal materials, privacy materials, cookie notices, security materials, support materials, and compliance materials;
▪customer, prospect, partner, supplier, reseller, and business-contact communications;
▪ordering, licensing, activation, account administration, billing, support entitlement, and customer relationship management;
▪software access, license validation, deployment identity, subscription validation, product integrity, security, diagnostic, and operational functions;
▪support, troubleshooting, implementation, migration, backup recovery, export assistance, or similar services where Customer chooses to provide information to HuoPuo;
▪customer-enabled AI features or external AI integrations, where applicable;
▪website cookies, HuoPuo cookie-consent records, Cloudflare security technologies, Stripe payment technologies where used, Google Analytics 4, and Google advertising products as described in the HuoPuo Cookie Policy; and
▪legal, compliance, security, fraud-prevention, dispute-resolution, and enforcement activities.
This Privacy Notice does not govern personal data processed solely by Customer in its own environment where HuoPuo has no access to that personal data, except to explain the allocation of responsibilities between HuoPuo and Customer.
Client Applications and product-specific notices. Some HuoPuo Client Applications may be distributed through application stores or provided for use in Customer-controlled, Customer-operated, or customer-branded services. Where an applicable Client Application, customer service, app-store listing, or product-specific privacy notice provides more specific privacy information for that application, that information supplements this Privacy Notice for the relevant processing. The data-protection roles of HuoPuo and the applicable Customer or operator depend on the actual processing arrangement, applicable law, and the applicable DPA, Order, or other written agreement.
3. Who We Are and Contacts
References in this Privacy Notice to "HuoPuo" mean HuoPuo, LLC, unless an applicable Order identifies another HuoPuo contracting entity as the relevant party for the applicable transaction.
| Purpose | Contact |
|---|---|
| Website | https://www.huopuo.com |
| General, commercial, licensing, administrative, and other non-legal inquiries unless a more specific channel is designated | info@huopuo.com |
| Security reports, vulnerability notifications, and suspected security incidents | security@huopuo.com |
| Contractual notices, legal notices, privacy requests, and data-subject requests | legal@huopuo.com |
The Security Contact address is intended for security reports, vulnerability notifications, suspected security incidents, and related security communications. Sending a communication to the Security Contact address does not, by itself, authorize security testing, penetration testing, vulnerability research, reverse engineering, circumvention, decryption, or any activity restricted by an applicable agreement.
Legal notices must be sent to the Legal Notice Address or another legal-notice address designated by HuoPuo in writing, except where mandatory law or an applicable written agreement requires another method.
4. Key Data Categories
4.1 Customer Data
Customer Data generally means data provided to, or generated within, the Software by or on behalf of Customer in the course of Customer’s authorized use of the Software, including Customer-owned business records, transactions, computed records, reports, entries, attachments, documents, and exports contained in a database, export, attachment repository, or backup file.
4.2 Operational Data
Operational Data generally means license-status data, deployment-identity data, activation data, entitlement data, version data, support-status data, security events, diagnostic data, performance metrics, and other technical or administrative information reasonably necessary for license administration, security, product integrity, support, service delivery, and legal compliance.
Operational Data does not include Customer business records merely because those records are stored in or processed by the Software. Any Operational Data that constitutes personal data remains subject to applicable data-protection law and applicable privacy terms.
5. Deployment Model
HuoPuo does not host Customer production systems on HuoPuo premises and does not currently provide standing Customer-production hosting as part of the ordinary deployment model unless a separate written Order expressly states otherwise.
Customer determines and controls where the HuoPuo system is deployed. Customer-selected environments may include Customer premises, Customer data centers, Customer-selected private cloud, Customer-selected public cloud, Customer-selected colocation, Customer-controlled sovereign cloud, Customer-controlled hosting providers, or another environment selected and approved by Customer.
HuoPuo does not obtain standing administrative or infrastructure access merely because HuoPuo software is installed in a Customer-controlled environment.
For HuoPuo website operations, HuoPuo may use a third-party website hosting or infrastructure provider. Provider details are not disclosed publicly unless HuoPuo elects to disclose them or an applicable written agreement, law, or customer-assurance process requires disclosure through a designated channel.
6. Data-Protection Roles
The parties’ data-protection roles depend on the actual processing activities and applicable law.
▪For Customer Data processed solely within Customer-controlled, on-premises, private-cloud, offline, encrypted-appliance, or Customer-selected environments where HuoPuo has no access, Customer ordinarily acts as controller, or equivalent role, for its own processing.
▪Where HuoPuo processes personal data on Customer’s behalf in connection with support, implementation, migration, export assistance, backup recovery, or another written instruction, HuoPuo ordinarily acts as processor, subprocessor, service provider, or equivalent role, as applicable.
▪For account, billing, license-status, deployment-identity, entitlement, security, website, payment-administration, communications, and Operational Data that HuoPuo determines and uses for its own legitimate administrative, security, fraud-prevention, product-integrity, service-delivery, and legal-compliance purposes, HuoPuo may act as an independent controller or equivalent role.
Nothing in this Privacy Notice overrides a role or obligation imposed by mandatory data-protection law.
7. Personal Data We May Process
| Category | Examples |
|---|---|
| Account and Business Contact Data | Names, business email addresses, business phone numbers, job titles, organization names, account identifiers, billing contacts, legal contacts, security contacts, support contacts, and communication records. |
| Licensing, Activation, and Entitlement Data | License-status data, activation data, deployment-identity data, entitlement data, version data, support-status data, subscription status, Licensed Scope information, Production Appliance identity, Recovery Appliance status, and deployment-integrity information. |
| Operational, Diagnostic, and Security Data | Security events, diagnostic data, performance metrics, system events, technical logs, error information, access events, integrity signals, product-integrity data, and technical/administrative information reasonably necessary for license administration, security, product integrity, support, service delivery, and legal compliance. |
| Customer Data provided for support | Where Customer supplies logs, screenshots, diagnostic reports, configuration information, extracts, files, technical descriptions, or similar support materials, HuoPuo may process the selected information to investigate, diagnose, or resolve the applicable support request. |
| AI-Related Data | Prompts, files, data sources, configuration choices, integration settings, outputs, logs, permissions, administrative confirmations, and records of Customer-enabled AI activity, depending on the feature, deployment model, configuration, and written agreement. |
| Website, Cookie, Chat, and Communication Data | Information submitted through HuoPuo websites, HuoPuo-operated chat, WhatsApp or other optional communication channels where used, email addresses and communication records, together with cookie identifiers, cookie-consent and preference choices, session/security identifiers, browser/device/network information, analytics identifiers, and advertising or conversion identifiers generated when the corresponding website technologies are used. |
| Payment and Billing Data | Billing, invoice, account, transaction, tax, payment-status, payment-provider, payment-method reference, and related commercial information necessary for billing, accounting, tax, fraud prevention, legal, payment-administration, subscription-management, and customer-account purposes. |
| Client Application and Device Data | Where an applicable Client Application enables the relevant feature and the applicable product-specific notice or app-store disclosure identifies the processing: device or app identifiers, device and operating-system information, notification or push tokens, precise or approximate location information where enabled, purchase or order history, user-selected photos, files, or other content, and usage or product-interaction data. The applicable Customer or operator may control some or all of this processing depending on the deployment and written arrangement. |
Sources of Personal Data. HuoPuo may obtain personal data directly from the individual; from the individual’s employer, organization, Customer, account administrator, Authorized User, partner, reseller, supplier, or other business contact; from payment providers, application stores and platform providers, website/security/infrastructure providers, communication providers, and Customer-enabled integrations; or from publicly accessible sources where permitted by applicable law. Where HuoPuo acts as processor, subprocessor, service provider, or equivalent role, Customer generally determines the sources of personal data and provides or makes the data available under documented instructions.
Required and Optional Data. Certain account, licensing, activation, billing, payment, security, legal, or transaction information may be required to enter into or perform a contract, activate or administer a license, process a requested payment, comply with law, or provide a requested service. If required information is not provided, HuoPuo may be unable to create or administer the account, enter into or perform the relevant transaction, activate or support the applicable license, process the payment, or provide the requested service. Other information is optional unless HuoPuo or the relevant interface states otherwise.
8. How We Use Personal Data
▪providing, maintaining, securing, validating, troubleshooting, migrating, exporting, and supporting the Software and related services;
▪administering accounts, Orders, licenses, subscriptions, support entitlements, billing, payment status, invoices, tax records, and commercial relationships;
▪validating license status, deployment identity, Licensed Scope, support status, subscription status, appliance identity, recovery status, and deployment integrity;
▪providing support or technical guidance based on information selected and supplied by Customer;
▪operating HuoPuo websites, essential and security cookies, preference and cookie-consent records, Cloudflare website-security technologies, HuoPuo-operated chat, Stripe payment technologies where used, Google Analytics 4, Google advertising products, and the consent mechanisms described in the HuoPuo Cookie Policy;
▪protecting product integrity, detecting misuse, investigating suspected unauthorized use, enforcing license restrictions, and preventing fraud;
▪responding to inquiries, support requests, security reports, legal requests, and customer communications;
▪maintaining security, confidentiality, auditability, operational integrity, and service reliability;
▪complying with applicable law, legal process, sanctions, export-control obligations, regulatory obligations, accounting/tax obligations, and contractual obligations;
▪managing disputes, enforcing agreements, preserving evidence, and protecting HuoPuo, Customer, users, and third parties; and
▪providing or administering customer-enabled AI features, where applicable and configured by Customer.
HuoPuo will not use Customer Data to train, fine-tune, or improve any AI or machine-learning model, whether HuoPuo’s or a third party’s, unless Customer gives prior express affirmative consent through an authorized administrative control or written agreement that identifies the relevant purpose and data use. General acceptance of an EULA or Order does not by itself constitute consent for AI training.
9. Legal Bases and Lawful Grounds
Where HuoPuo acts as an independent controller or equivalent role, HuoPuo processes personal data only where it has an applicable legal basis or lawful ground under the law that applies to the relevant processing. Depending on the context and jurisdiction, this may include contract performance or pre-contract steps, legitimate interests, legal obligations, consent where required, protection of rights and security, or another lawful ground recognized by applicable law.
| Processing context | Typical lawful ground or legal basis |
|---|---|
| Account, ordering, licensing, billing, payment administration, support, and business communications | Contract performance or pre-contract steps; legitimate interests in operating HuoPuo’s business and services; legal obligations for tax, accounting, sanctions, compliance, or records where applicable. |
| License validation, deployment identity, product integrity, fraud prevention, security, diagnostics, and Operational Data | Contract performance; legitimate interests in protecting HuoPuo products, customers, users, systems, and legal rights; legal obligations where applicable. |
| Website operation, essential/security cookies, requested preference cookies, payment cookies, cookie-consent records, HuoPuo-operated chat, and response to inquiries | Legitimate interests, requested service, pre-contract steps, or contract performance, as applicable, for necessary website operation, security, requested preferences, payment functionality, consent records, and communications. |
| Analytics, advertising, marketing, and other non-essential tracking technologies | Consent under HuoPuo's current website configuration. As described in the HuoPuo Cookie Policy, Google Analytics 4 and Google advertising cookies are non-essential and are placed only after the visitor gives the applicable consent. |
| Customer Data processed by HuoPuo on behalf of Customer | Customer’s documented instructions under the applicable Order, DPA, support request, configuration, or written authorization. Customer is responsible for its own lawful basis where Customer acts as controller or equivalent role. |
| AI features | Contract performance and Customer instructions for customer-enabled AI features. HuoPuo does not use Customer Data for AI training, fine-tuning, or model improvement without prior express affirmative Customer consent. |
| Legal compliance, disputes, enforcement, audit, sanctions, export control, and regulatory matters | Legal obligation; legitimate interests in establishing, exercising, or defending rights; compliance with mandatory law or lawful process. |
This section does not determine the lawful basis for Customer’s own processing of Customer Data. Customer is responsible for determining and documenting its own lawful basis or legal ground where Customer acts as controller or equivalent role.
10. License Verification and Operational Data
HuoPuo Proprietary Materials may include license validation, activation, subscription validation, deployment-integrity, anti-tamper, support-entitlement, recovery-lifecycle, or related verification functions.
In HuoPuo’s standard commercial configuration, ordinary license-validation functions are designed to validate license status, deployment identity, Licensed Scope, support status, subscription status, Production Appliance identity, Recovery Appliance status, and deployment integrity.
Unless separately authorized by written agreement, applicable law, support request, customer-administered configuration, or other authorization documented in writing, ordinary license-validation functions are not designed to access, read, collect, modify, or transmit Customer business records, accounting entries, payroll records, inventory records, operational transactions, documents, attachments, or other Customer Data.
Except as separately agreed or reasonably required for support, security, legal compliance, recovery, archival access, or service delivery under a written agreement, HuoPuo does not ordinarily require access to Customer Data for ordinary license validation.
11. Customer Data
As between HuoPuo and Customer, Customer retains rights in Customer Data, subject to the applicable written agreement and applicable law.
Customer grants HuoPuo a limited, non-exclusive license to process Customer Data solely to provide, maintain, secure, validate, troubleshoot, migrate, export, and support the Software and related services under the applicable written agreement, and only to the extent HuoPuo has access to such Customer Data.
During the term, Customer may export Customer Data using the Software’s standard export functionality, subject to the Licensed Scope, documentation, security controls, applicable law, and applicable written agreement.
In Customer-controlled deployments, Customer is responsible for its own retention, deletion, backup, archive, and export decisions for Customer Data, except to the extent HuoPuo expressly assumes a specific obligation under an applicable Order, DPA, or written agreement.
12. AI Features and External AI Integrations
Customer remains responsible for the data sources, prompts, files, integrations, external services, third-party providers, and features that Customer or its users enable, connect, activate, configure, or use, including any third-party AI service that Customer chooses to connect, activate, or use.
External AI integrations are customer-administered configurations unless the applicable Order states otherwise. HuoPuo may require administrative warnings, enablement confirmations, audit logs, permissions, or other controls before external AI features are activated.
Customer is responsible for reviewing the data-handling, training, retention, security, confidentiality, privacy, and subprocessor terms of any third-party AI service selected or enabled by Customer. No standalone third-party AI provider is currently identified as processing Personal Data for HuoPuo-controlled services.
Automated Decision-Making and Profiling. HuoPuo does not currently identify any HuoPuo-controlled processing under this Privacy Notice that makes decisions about individuals based solely on automated processing, including profiling, and produces legal effects or similarly significant effects. If such processing is introduced or identified for a particular product or service, HuoPuo will disclose it in the applicable privacy information and provide the information and safeguards required by applicable law, which may include meaningful information about the logic involved, the significance and envisaged consequences of the processing, and applicable rights to human intervention, review, or contest.
13. Payments and Billing
HuoPuo currently uses Stripe Elements / Stripe Payment Element for payment-card functionality. HuoPuo may use Stripe where applicable and may add other approved third-party payment service providers from time to time. Payment-card information is processed by the applicable payment service provider through its secure payment infrastructure and under its own terms, privacy notice, data-processing terms, security standards, and payment-network obligations.
HuoPuo does not receive or store sensitive payment-card data, including full payment card numbers (full PAN), CVV/CVC codes, PINs, or full magnetic-stripe/track data. Full PAN and CVV/CVC do not reach HuoPuo servers in the current payment architecture.
HuoPuo may receive and retain limited payment-related information necessary to administer transactions, invoices, subscriptions, refunds, disputes, fraud prevention, accounting, tax, and customer-account functions, depending on the payment integration and the information made available by the applicable payment service provider.
Limited payment-related information may include Stripe PaymentIntent or transaction references, Stripe PaymentMethod or token references, Stripe Customer ID where required, provider name, amount, currency, payment status, date/time, invoice and billing information, last four digits of the card, and card brand/type. HuoPuo does not store card expiry month/year as part of its application payment record under the current payment architecture.
| Information | HuoPuo systems | Payment service provider |
|---|---|---|
| Full payment card number (full PAN) | No | Yes - handled by the applicable provider |
| CVV/CVC | No | Used by the provider at authorization; not retained by HuoPuo as reusable card data |
| PIN or full magnetic-stripe/track data | No | Handled only by card network/provider systems where applicable; not held by HuoPuo |
| Payment token / Payment Method ID / provider reference | Yes - where needed for transactions, saved payment methods, or subscriptions | Yes - corresponding provider reference |
| Transaction, PaymentIntent, authorization, settlement, or refund reference | Yes | Yes |
| Provider name, amount, currency, date/time, payment status, invoice and billing data | Yes | Yes, as applicable |
| Limited payment-method metadata: last four digits and card brand/type | Yes - where provided by Stripe/provider and needed | Yes, as provider/payment-network data |
| Card expiry month/year | No, under current application payment record | Yes, as provider/payment-network data where applicable |
For recurring or subscription payments, HuoPuo uses tokenization or provider-issued references where supported by the payment service provider. When Customer saves a payment method, HuoPuo stores the payment token, payment-method identifier, or provider reference issued by the payment service provider, not the underlying full card number. HuoPuo uses that token or reference to instruct the payment service provider to charge the corresponding saved payment method; HuoPuo does not independently hold reusable card credentials.
14. Website Cookies, Analytics, Tracking, and Chat
HuoPuo websites use essential and security cookies and similar technologies to operate the website, maintain sessions, protect forms and authenticated operations, and support network security. This includes HuoPuo session and CSRF cookies and Cloudflare security cookies. HuoPuo also uses preference and consent cookies to remember requested language choices and record cookie-consent selections, and Stripe cookies where a visitor uses Stripe payment functionality for payment security, authentication, or fraud prevention.
HuoPuo uses Google Analytics 4 to understand website use and performance and uses Google advertising products for campaign measurement, conversion tracking, and remarketing. These analytics and advertising technologies are non-essential and, under HuoPuo's current configuration, are placed only after consent. HuoPuo uses Google Consent Mode so that, until consent is given, ad_storage, ad_user_data, ad_personalization, and analytics_storage are set to denied and Google tags do not read or write advertising or analytics cookies.
The HuoPuo cookie banner allows visitors to accept all cookies, reject non-essential cookies, or manage preferences by category. Visitors may later change or withdraw consent through the cookie-preferences link in the website footer. HuoPuo does not currently use a third-party chat-widget provider. Exact cookie names, providers, purposes, durations, consent status, and browser-control information are set out in the HuoPuo Cookie Policy.
15. Communications Channels, including WhatsApp
HuoPuo may use WhatsApp or similar messaging channels for general business communications where applicable. WhatsApp is optional and is not HuoPuo’s required support channel, legal-notice channel, privacy-request channel, or security-reporting channel.
Customers should not send passwords, credentials, payment-card data, regulated data, confidential Customer Data, or sensitive diagnostic materials through WhatsApp unless HuoPuo expressly designates an appropriate secure process.
16. Sharing and Service Providers
HuoPuo may disclose personal data where reasonably necessary for the purposes described in this Privacy Notice and permitted by applicable law and the applicable written agreement.
Confirmed or currently identified external providers may include a third-party website hosting or infrastructure provider for HuoPuo's public website, Cloudflare for website network security and performance, Stripe for payment processing, Google for Google Analytics 4 and advertising products, Apple and Google as application-store or platform providers where applicable Client Applications are distributed through their services, and Meta/WhatsApp where WhatsApp is used for optional general business communications.
Systems operated directly by HuoPuo are not separate third-party providers. Customer-controlled environment providers selected by Customer are not HuoPuo subprocessors merely because Customer uses them to host or operate the Software.
17. International Processing and Transfers
Depending on the deployment model, Customer instructions, support request, website operation, subprocessor location, communication channel, payment provider, AI integration, or legal requirement, personal data may be processed in more than one country.
HuoPuo website-related data may be hosted or processed in the United States or in other locations used by HuoPuo's website hosting or infrastructure provider, Cloudflare, Google, communication providers, payment providers, or other applicable service providers. As described in the HuoPuo Cookie Policy, Google and Cloudflare have international operations and information collected through their website technologies may be processed outside the visitor's country, including in the United States. Customer production deployments remain Customer-controlled unless a separate written Order expressly states otherwise.
Where applicable data-protection law restricts cross-border transfers of personal data, the parties will rely on an appropriate lawful transfer mechanism, such as an adequacy decision, Standard Contractual Clauses, a transfer addendum, or another valid mechanism, as identified in the applicable DPA or privacy documentation.
Where applicable law entitles an individual to information about a transfer safeguard, the individual may request information about or, where legally available, a copy of the relevant safeguard by contacting legal@huopuo.com. HuoPuo may redact confidential or commercially sensitive information where permitted by law without preventing the individual from receiving the substance of the applicable safeguard.
18. Security
HuoPuo may use technical and organizational measures designed to support security, confidentiality, product integrity, access control, license administration, operational integrity, and legal compliance. Depending on the deployment model and written agreement, these measures may relate to license validation, deployment identity, activation, security events, diagnostic data, access controls, logging, encryption, protected runtime environments, backup and recovery mechanisms, support procedures, and vulnerability reporting.
No software, system, deployment, network, or transmission method can be guaranteed to be secure against all threats. This Privacy Notice does not create a security warranty, certification, audit result, penetration-testing claim, compliance certification, or service-level commitment unless expressly stated in an applicable written agreement.
Security reports and vulnerability notifications may be submitted to security@huopuo.com.
19. Support Access and Support Data
HuoPuo does not directly or remotely access Customer machines, servers, databases, networks, endpoints, cloud environments, or other Customer-controlled infrastructure. HuoPuo does not use VPN, SSH, Remote Desktop, remote-control software, privileged Customer accounts, unattended support agents, standing support accounts, administrative Customer passwords, or backdoor access mechanisms for Customer environments.
Technical support is performed through information selected and supplied by Customer. Customer may provide logs, screenshots, error messages, diagnostic reports, configuration information, relevant extracts, files, technical descriptions, or other information considered necessary for troubleshooting.
HuoPuo analyses the supplied information and may provide instructions, commands, configuration changes, scripts, patches, updates, remediation procedures, or other technical guidance. Customer or its authorized personnel executes those actions within the Customer environment. Customer-controlled screen sharing may be used for observation and guidance, provided that HuoPuo does not take remote control of the Customer machine.
Customers should provide only information reasonably necessary to reproduce, investigate, diagnose, or resolve the relevant technical issue. Where reasonably practicable, support materials should be anonymized, pseudonymized, redacted, or otherwise minimized before transmission to HuoPuo. Customers must not provide passwords, private keys, authentication secrets, complete payment-card credentials, CVV/CVC values, or comparable security credentials through ordinary support channels.
20. Retention
HuoPuo retains personal data for as long as reasonably necessary for the relevant purpose, including account administration, licensing, billing, payment administration, support, security, legal compliance, dispute resolution, tax/accounting requirements, product integrity, and enforcement of agreements, unless a longer or shorter period is required by applicable law, regulation, binding regulatory requirement, contractual obligation, documented legal hold, or written agreement.
Where applicable law establishes a mandatory retention period, that mandatory period prevails over HuoPuo’s ordinary retention schedule. Where no specific statutory retention period applies, HuoPuo determines and documents an appropriate retention period based on the purpose of processing, the nature and sensitivity of the information, contractual requirements, applicable limitation periods, security requirements, and the risks associated with continued retention.
| Data category | Retention approach |
|---|---|
| Account and Business Contact Data | Retained while reasonably needed for the business relationship, account administration, communications, legal/commercial records, dispute handling, and applicable accounting or legal obligations. |
| Licensing, Activation, and Entitlement Data | Retained while reasonably needed to administer licenses, Licensed Scope, support entitlement, product integrity, anti-fraud controls, security, audit, dispute handling, and legal compliance. |
| Operational, Diagnostic, and Security Data | Retained for the period reasonably necessary for security, fraud prevention, product integrity, troubleshooting, audit, legal compliance, dispute handling, and enforcement purposes, unless a longer or shorter period is required by applicable law, contractual obligation, investigation, legal hold, or documented security need. |
| Customer-supplied ordinary support attachments | Logs, screenshots, diagnostic reports, configuration exports, sample files, error reports, and similar troubleshooting materials are ordinarily deleted when no longer required and, unless a documented exception applies, no later than thirty (30) days after final closure of the applicable support ticket. |
| Sensitive diagnostic information | Deleted as soon as reasonably practicable after it is no longer required for the applicable support purpose. HuoPuo’s operational target is deletion no later than seven (7) days after final ticket closure unless law, Controller instructions, contractual requirements, investigation, or legal hold requires otherwise. |
| Support ticket records and technical findings | Support-ticket metadata, correspondence, technical findings, root-cause information, remediation records, and resolution history may be retained for operational support, service quality, audit, security, contractual administration, and establishment, exercise, or defense of legal claims. Underlying Customer-supplied diagnostic attachments are not retained merely because the ticket record is retained. |
| Payment, invoice, accounting, and tax records | Ordinarily retained for seven (7) years where reasonably appropriate for U.S.-oriented tax/accounting/commercial recordkeeping, unless a longer or shorter period is required or permitted by applicable law, regulation, written agreement, legal hold, or documented business/legal requirement. |
| Website, cookie, chat, WhatsApp, and communication data | Browser-cookie lifetimes are specified in the HuoPuo Cookie Policy. HuoPuo's cookie-consent cookie is configured for 1 year, and HuoPuo's Google Analytics user-level and event-level data-retention setting is 2 months. Security, preference, payment, analytics, and advertising cookie lifetimes otherwise vary by cookie and provider as listed in the Cookie Policy. Other website, chat, WhatsApp, and communication data is retained according to the relevant operational purpose, inquiry or communication needs, provider settings, applicable law, and documented business or legal requirements. |
| Backups | Data deleted from active systems may remain in protected backup copies until the relevant backup cycle expires. Residual backup copies are protected and are not restored or processed for ordinary business purposes. For ordinary support information, HuoPuo targets elimination of residual backup copies within thirty (30) days after deletion from active systems, unless a longer period is technically unavoidable or required by applicable law or legal hold. |
| Customer Data in Customer-controlled deployments | Customer is responsible for its own retention, deletion, backup, archive, and export decisions, except to the extent HuoPuo expressly assumes a specific obligation under an applicable Order, DPA, or written agreement. |
Information reaching the end of its retention period is securely deleted, destroyed, anonymized, or otherwise rendered inaccessible using methods appropriate to the storage technology, information classification, sensitivity, and applicable legal or regulatory requirements.
21. Data Subject Rights
Depending on applicable law and the role in which HuoPuo processes the relevant personal data, individuals may have rights to request access, correction or rectification, deletion or erasure, restriction of processing, objection, portability, withdrawal of consent, or other rights provided by applicable data-protection law.
Where HuoPuo acts as processor, service provider, subprocessor, or equivalent role for Customer, HuoPuo may refer the request to Customer or assist Customer in accordance with the applicable DPA, Order, written instruction, and applicable law. Where HuoPuo acts as an independent controller or equivalent role, HuoPuo will handle applicable requests in accordance with applicable law. Privacy requests may be submitted to legal@huopuo.com unless HuoPuo designates a more specific privacy channel.
Where processing is based on consent, individuals may withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal. Where applicable law provides a right to object, including to certain direct-marketing or legitimate-interest processing, individuals may exercise that right by contacting legal@huopuo.com or by using an applicable preference or unsubscribe mechanism.
Individuals may also have the right to lodge a complaint with the competent data-protection supervisory authority, including an authority in the country or region where they live or work or where an alleged infringement occurred. HuoPuo encourages individuals to contact legal@huopuo.com so that HuoPuo can address privacy concerns, but contacting HuoPuo first is not a condition of making a complaint where applicable law provides that right.
22. Customer Responsibilities
Customer is responsible for:
▪the lawfulness, accuracy, quality, and content of Customer Data;
▪providing required notices to its own data subjects;
▪obtaining required consents or other legal permissions;
▪determining its own lawful basis or legal ground for processing Customer Data;
▪configuring the Software, AI features, permissions, roles, and administrative settings lawfully;
▪managing retention, deletion, backup, archive, and export decisions for Customer Data;
▪selecting and controlling its hosting, on-premises, private-cloud, offline, or other Customer-controlled environment unless an Order expressly states otherwise;
▪identifying any data-localization, residency, sectoral, restricted-connectivity, or in-country hosting requirement that applies directly to Customer; and
▪minimizing, redacting, anonymizing, or pseudonymizing support materials before sending them to HuoPuo where reasonably practicable.
23. Children and Minors
HuoPuo's enterprise Software and related services are intended primarily for business, commercial, professional, organizational, governmental, institutional, contractor, freelancer, and other use connected wholly or mainly with a trade, business, craft, profession, organization, or public function. Some Client Applications developed or distributed by HuoPuo may, however, be customer-operated, customer-branded, or consumer-facing. In those cases, the applicable Customer or operator, product-specific privacy notice, app-store disclosure, and written arrangement determine the intended audience and the data-protection roles for the relevant application.
HuoPuo does not knowingly collect personal data from children for HuoPuo's own independent purposes except where the processing is expressly disclosed, lawfully permitted, and subject to any required parental or guardian authorization or other safeguards. A Customer that uses the Software or a Client Application to process children's or minors' personal data is responsible for identifying applicable age thresholds and complying with laws that apply to its processing, including required notices, consents, age-assurance measures, safeguards, or restrictions. Where HuoPuo acts as processor, subprocessor, service provider, or equivalent role, HuoPuo processes such data only as permitted by the applicable DPA, documented instructions, and applicable law.
24. Third-Party Services and Integrations
Customer may choose to enable, connect, activate, configure, or use third-party services, integrations, external services, third-party providers, or third-party AI services with HuoPuo products or services. Customer is responsible for reviewing the data-handling, training, retention, security, confidentiality, privacy, and subprocessor terms of any third-party service selected or enabled by Customer.
HuoPuo is not responsible for privacy practices of third-party services that Customer independently selects, enables, connects, activates, configures, or uses, except to the extent an applicable written agreement or mandatory law provides otherwise.
25. Changes
HuoPuo may update this Privacy Notice from time to time. Updated privacy materials may be made available through the HuoPuo website, legal materials, customer portal, documentation, applicable Order, or another location or method designated by HuoPuo.
Where required by applicable law or written agreement, HuoPuo will provide notice of material changes in the manner required. The publication of privacy materials, legal materials, compliance materials, or other information on a HuoPuo website or portal does not, by itself, amend an applicable EULA or Order except as expressly provided in the applicable contractual terms.
26. Contact
▪Website: https://www.huopuo.com
▪General Contact: info@huopuo.com
▪Security Contact: security@huopuo.com
▪Legal Notice / Privacy Requests: legal@huopuo.com
Privacy requests may be submitted to the Legal Notice Address unless HuoPuo designates a more specific privacy channel. Security reports should be submitted to the Security Contact address. Contractual or legal notices must be sent to the Legal Notice Address or another legal-notice address designated by HuoPuo in writing, except where mandatory law or applicable procedural rules require another method.