ThinkingAI Privacy Policy
Release date of this Privacy Policy: April 16, 2026
Effective date of this Privacy Policy: April 16, 2026
Preface
数数信息科技（上海）有限公司 (address: 上海市徐汇区桂平路391弄A座4楼; hereinafter "we" or the "Company") is the personal information processor described in this Privacy Policy. We are responsible for determining the purposes and methods of personal information processing, and bear the legal responsibilities of a personal information processor in accordance with the law.
This Privacy Policy (hereinafter "this Policy") is formulated in accordance with the Personal Information Protection Law of the People's Republic of China, the Cybersecurity Law of the People's Republic of China, the Data Security Law of the People's Republic of China, the Regulations for the Implementation of the Personal Information Protection Law, and other relevant laws and regulations. It explains how we collect, use, store, share, transfer, and disclose your personal information when we provide the official website (https://thinkingai.io), the Agentic Engine big data analytics system, and related products and services (hereinafter the "Services"), and how you can exercise your rights regarding your personal information.
Before you use our Services, read this Policy carefully and make sure you fully understand it. Terms that involve your rights and obligations are marked in bold. If you have any questions, comments, or suggestions about this Policy, you can contact us using the methods provided in this Policy.
This Policy will help you understand the following:
1. Definitions
2. How we collect and use your personal information
3. How we use cookies and similar technologies
4. How we share, transfer, and publicly disclose your personal information
5. How we store and protect your personal information
6. Your rights
7. Protection of minors' personal information
8. How this Privacy Policy is updated
9. How to contact us
Appendix: Personal information collection list
1. Definitions
To help you understand this Policy, we use the following definitions in this Policy:
(1) Personal information: All kinds of information related to identified or identifiable natural persons that is recorded electronically or by other means, excluding information that has been anonymized. (Under the Personal Information Protection Law)
(2) Sensitive personal information: Personal information that, once leaked or illegally used, can easily lead to infringement of the personal dignity of natural persons or harm to their personal or property safety, including information on biometrics, religious beliefs, specific identities, medical health, financial accounts, and whereabouts, as well as the personal information of minors under the age of fourteen. (Under the Personal Information Protection Law)
(3) Personal information processor: An organization or individual that independently determines the purposes and methods of processing in personal information processing activities. We are the processor of your personal information.
(4) Affiliates: Any company or entity that directly or indirectly controls us, is controlled by us, or is under common control with us by another party. "Control" means directly or indirectly having the power to direct the business decisions of an entity through holding equity, voting rights, or other means.
2. How we collect and use your personal information
We collect and use your personal information only for the purposes described in this Policy. If we need to use your personal information for other purposes, we will ask for your consent again.
(1) Information you provide to us
When you use our Services, you may provide us with relevant personal information:
- Account sign-up and login: When you sign up for an Agentic Engine account or log in to our Services, you need to provide your mobile phone number (used to receive verification codes to complete sign-up and login) and a password. If you refuse to provide them, you will not be able to complete sign-up or login.
- Identity verification and binding: To keep your account secure, you may need to bind your email address, name, or job title at your company. If you refuse to provide them, you may not be able to use the binding feature, but this does not affect your use of other basic services.
- Customer service and feedback: When you contact us by phone, email, or online form, or submit feedback in the product, we collect the feedback content, contact information, and communication records that you provide, so that we can handle your request or improve our Services.
(2) Information we collect automatically when you use the Services
To ensure the normal operation of the Services, improve service quality, and keep your account secure, we automatically collect the following information when you use the Services:
- Device and log information: When you visit our website or use the Agentic Engine system, our servers may automatically record information such as your IP address, browser type, operating system version, device model, device identifiers, network status, access date and time, and operation logs.
- Service usage data: Includes the feature modules you use, operation records, page browsing paths, error information, and clickstream data.
(3) Processing of sensitive personal information
We do not actively collect your sensitive personal information. However, if you actively provide content that involves sensitive personal information while using the Services, we will take stricter protection measures in accordance with the law:
- We process the sensitive personal information you provide only with your explicit consent and only when the processing purpose is specific and necessary.
- We apply enhanced protection measures, such as encrypted storage and access control, to sensitive personal information.
- If you need to handle scenarios that involve sensitive personal information, contact us in advance, and we will provide a dedicated processing solution.
(4) Exceptions to obtaining consent
In accordance with relevant laws and regulations, we may collect and use your personal information without your consent in the following circumstances:
(a) Where necessary to perform statutory duties or statutory obligations;
(b) Where necessary to conclude or perform a contract to which you are a party;
(c) Where necessary to respond to a public health emergency, or to protect the life, health, and property safety of natural persons in an emergency;
(d) Where personal information is processed within a reasonable scope to carry out news reporting, public opinion supervision, and other activities in the public interest;
(e) Where personal information that you have disclosed yourself, or that has otherwise been lawfully disclosed, is processed within a reasonable scope in accordance with the law;
(f) Other circumstances stipulated by laws and administrative regulations.
(5) Joint processing and entrusted processing of personal information
In some scenarios, we may process your personal information jointly with third parties (for example, when integrating third-party login), or entrust third parties to process data on our behalf (for example, cloud service providers). In such cases, we will:
- Specify the data security obligations and responsibilities of each party by contract;
- Supervise third parties in taking adequate security measures;
- Require third parties to comply with relevant laws and regulations and with our agreements;
- For details about these third parties, see our Third-Party Information Sharing List.
3. How we use cookies and similar technologies
To ensure that our website runs properly, improve your browsing experience, and perform access statistics and analysis, we store cookies, tags, scripts, and similar technologies (collectively, "Cookies") on your computer or mobile device.
(1) Functional necessity: Some Cookies are strictly necessary to provide the Services. If you disable these Cookies, you may not be able to use our Services or some of their features.
(2) Analysis and optimization: We may use Cookies to collect statistics and understand how users use our website, so that we can analyze and improve our Services.
(3) Your control: You can manage or delete Cookies according to your preferences. Most web browsers provide a feature to block Cookies. However, if you disable Cookies, your experience of using our Services may be affected.
(4) Do Not Track: If Do Not Track is enabled in your browser, we will respect your choice.
4. How we share, transfer, and publicly disclose your personal information
We attach great importance to the protection of your personal information. In principle, we do not share, transfer, or publicly disclose your personal information to third parties, except in the following cases:
(1) Sharing
We do not share your personal information with any company, organization, or individual outside ThinkingAI, except in the following cases:
- With your explicit consent: We will obtain your separate consent before sharing.
- Sharing with our affiliates: Only for the purposes stated in this Privacy Policy, your personal information is managed by us centrally or processed jointly with our affiliates. However, we share only the necessary personal information, and our affiliates' processing and protection of your personal information are subject to this Privacy Policy.
- Sharing with authorized partners: Only to achieve the purposes stated in this Policy, some of our services are provided jointly by us and authorized partners. We may share some of your personal information with partners to provide better customer service and user experience. We share your personal information only for lawful, legitimate, necessary, specific, and explicit purposes, and our partners have no right to use the shared personal information for any other purpose.
- Third-party SDKs: Our products may integrate third-party SDKs, which may collect your device information or log information. We conduct strict security assessments of these third parties and require them to comply with relevant laws and regulations and with our agreements. For the specific SDK names, types of information collected, and purposes, see our Third-Party Information Sharing List.
(2) Transfer
We do not transfer your personal information to any company, organization, or individual, except in the following cases:
In the case of a merger, acquisition, asset transfer, bankruptcy liquidation, or similar event that involves the transfer of personal information, we will require the new company or organization that holds your personal information to continue to be bound by this Policy. If the purpose or method of processing personal information changes, we will require it to obtain your consent again.
(3) Public disclosure
We publicly disclose your personal information only in the following cases:
- With your separate consent;
- Based on laws, legal procedures, litigation, or mandatory requirements of competent government authorities.
(4) Circumstances exempt from consent
In the following circumstances, we may share, transfer, or publicly disclose your personal information without your consent:
(a) Where necessary to perform statutory duties or statutory obligations;
(b) Where necessary to conclude or perform a contract to which you are a party;
(c) Where necessary to respond to a public health emergency, or to protect the life, health, and property safety of natural persons in an emergency;
(d) Where personal information is processed within a reasonable scope to carry out news reporting, public opinion supervision, and other activities in the public interest;
(e) Where personal information that you have disclosed yourself, or that has otherwise been lawfully disclosed, is processed within a reasonable scope in accordance with the law;
(f) Other circumstances stipulated by laws and administrative regulations.
5. How we store and protect your personal information
(1) Storage location
Personal information that we collect and generate in our operations within the People's Republic of China is stored within the People's Republic of China. If the information needs to be provided outside China, we will strictly comply with relevant laws and regulations, obtain your separate consent, and take necessary security measures.
(2) Retention period
We retain your personal information only for the shortest period necessary to achieve the purposes of the Services, unless the law imposes a mandatory retention requirement.
If our Services cease operation, or we are dissolved or go bankrupt, we will promptly stop collecting personal information, notify you of the cessation of operation by individual notice or public announcement, and delete or anonymize the personal information we hold.
(3) Security protection measures
We have established industry-standard technical and organizational security measures to protect your information from unauthorized access, public disclosure, use, modification, damage, or loss.
- Technical measures:
(a) Use encryption technologies (such as SSL/TLS) to ensure the confidentiality of data transmission;
(b) Use trusted protection mechanisms to protect data from malicious attacks;
(c) Deploy access control mechanisms to ensure that only authorized personnel can access personal information;
(d) Implement security audit mechanisms to record and monitor data processing activities.
- Organizational measures:
(a) Establish a data security management system that specifies the security responsibilities of personnel at all levels;
(b) Provide regular security training for employees to raise their security awareness;
(c) Set up a dedicated data security team responsible for daily security management and emergency response;
(d) Conduct regular security risk assessments and vulnerability checks.
- Account security: The internet is not an absolutely secure environment. Keep your account, password, and other authentication factors safe. If you find that your account has been stolen or your information has been leaked, contact us immediately.
(4) Security incident handling
If a personal information security incident unfortunately occurs, we will take the following measures as required by laws and regulations:
- Promptly inform you of the basic situation and possible impact of the security incident, the measures we have taken, and suggestions on how you can prevent and reduce risks on your own;
- Inform you by email, letter, phone, push notification, or other means;
- Promptly report the incident to regulatory authorities where required by laws and regulations.
6. Your rights
Under the Personal Information Protection Law and other relevant laws and regulations, you, as a personal information subject, have the following rights:
(1) Right to know and right to decide
You have the right to know the purposes, methods, and scope of our processing of your personal information, and to make decisions about our processing of your personal information.
(2) Right to access and right to copy
You have the right to access and copy your personal information.
- You can access basic information such as your account display name, bound phone number, and email address in Personal Center.
- To access or copy other personal information generated while you use the Services, contact us using the methods provided in this Policy.
(3) Right to correct and right to supplement
You have the right to ask us to correct or supplement inaccurate or incomplete personal information. You can modify your account information in Personal Center, or contact us using the methods provided in this Policy.
(4) Right to delete
You have the right to ask us to delete your personal information in the following circumstances:
(a) The processing purpose has been achieved or cannot be achieved, or the processing is no longer necessary to achieve the processing purpose;
(b) We stop providing the products or services, or the retention period has expired;
(c) You withdraw your consent;
(d) We process personal information in violation of laws, administrative regulations, or agreements;
(e) Other circumstances stipulated by laws and administrative regulations.
If the retention period stipulated by laws and administrative regulations has not expired, or if deleting the personal information is technically difficult, we will stop all processing other than storage and taking necessary security protection measures.
(5) Right to withdraw consent
You have the right to withdraw your consent to our processing of your personal information. Withdrawing consent does not affect the validity of personal information processing activities carried out based on your consent before the withdrawal.
You can withdraw your consent in the following ways:
- Turning off device features and permissions in system settings;
- Contacting us using the methods provided in this Policy.
(6) Account deletion
If you want to delete your Agentic Engine account, you can contact us using the methods provided in this Policy. After your account is deleted, we will no longer collect your personal information, and we will delete or anonymize your personal information within the period required by laws and regulations.
(7) How to exercise your rights
For security reasons, you may need to provide a written request or otherwise prove your identity. We have the right to process your request only after verifying your identity.
In principle, we do not charge fees. However, for repeated requests that exceed a reasonable limit, we may charge a certain cost-based fee as appropriate. We have the right to reject requests that are unreasonably repetitive, require excessive technical means, pose risks to the legitimate rights and interests of others, or are highly impractical.
We will accept and process your request within 15 working days. Barring special circumstances, we will promptly inform you of the processing result.
7. Protection of minors' personal information
Our products and services are mainly intended for enterprise users and individuals aged 18 or over. Minors should not use our products and services. If a related account was registered by mistake or for similar reasons, contact us (or have your parent or guardian contact us) promptly using the contact information provided in this Privacy Policy so that we can handle it (including deleting the account and the personal information).
8. How this Privacy Policy is updated
We may revise this Policy from time to time. If any of the following changes occur, we will notify you by pop-up window, push notification, website announcement, or other means:
(a) Our name or contact information changes;
(b) The purposes or methods of processing personal information, the types of personal information processed, or the retention period changes;
(c) The methods and procedures for exercising your statutory rights change;
(d) Other matters that must be notified as stipulated by laws and administrative regulations.
We will not reduce your rights under this Policy without your explicit consent. If you do not agree with the revised Privacy Policy, you have the right to stop using our Services immediately.
9. How to contact us
If you have any questions, comments, or suggestions about this Privacy Policy, or need to exercise your rights regarding your personal information, you can contact us in the following ways:
Company name: 数数信息科技（上海）有限公司
Registered address: 上海市徐汇区桂平路391弄A座4楼
Contact email: privacy@thinkingai.cn
Email of the person in charge of personal information protection: privacy@thinkingai.cn
Generally, we will accept and process your request within 15 working days.
If you are not satisfied with our response, or believe that our personal information processing activities have harmed your legitimate rights and interests, you have the right to file a complaint or report with the following authorities:
(a) File a complaint or report with the Shanghai Municipal Cyberspace Administration Office;
(b) File a complaint or report with the Shanghai Communications Administration;
(c) Call the 12315 hotline to file a complaint or report with the market regulation authorities.
Appendix: Personal information collection list
The following is a list of the personal information we collect in the course of providing the Services:
| Information category | Specific information type | Purpose of collection | Collection method | Required or optional |
|---|---|---|---|---|
| Account information | Mobile phone number, password | Account sign-up and login | Provided by the user | Required |
| Account information | Email address | Identity verification and binding | Provided by the user | Optional |
| Account information | Name, company | Identity verification and binding | Provided by the user | Optional |
| Device information | IP address, device model | Service operation and security | Collected automatically | Required |
| Device information | Browser type, operating system | Service operation and optimization | Collected automatically | Required |
| Log information | Access time, operation logs | Security audit | Collected automatically | Required |
| Usage data | Feature usage records, page views | Service improvement | Collected automatically | Optional |
| Customer service information | Feedback content, contact information | Customer service | Provided by the user | Optional |
Note: "Required" means that the information is necessary for the normal operation of the Services, and if you refuse to provide it, you cannot use the corresponding features. "Optional" means that the information is needed for value-added features, and if you refuse to provide it, your use of the basic features is not affected.