Welmo Technology Privacy Policy

This English version is a courtesy translation. In case of any discrepancy between the Chinese and English versions, the Chinese version shall prevail.

Important Notice

Henan Welmo Technology Co., Ltd. understands the importance of personal information to you and will strictly comply with the PRC Personal Information Protection Law (PIPL), the PRC Cybersecurity Law (CSL), the PRC Data Security Law (DSL), and related national standards. We adopt security measures commensurate with our business scale to process your personal information.

This Privacy Policy explains in detail how we collect, use, share, store, and protect your personal information, and the rights you enjoy. Provisions in bold concern your significant rights — please read them carefully. If you do not agree with any provision, please immediately stop using the Service.

Special Notice: Welmo Technology currently stores its core business data on Alibaba Cloud's Hong Kong nodes. This constitutes "cross-border provision of personal information" under Articles 38 and 39 of the PIPL. We will provide a dedicated notice in Section 6 and obtain your explicit "separate consent" through product-side mechanisms.

1. Introduction and Scope

1.1 Who We Are

• Company Name: Henan Welmo Technology Co., Ltd.
• Unified Social Credit Code: 91410103MAG119PD2T
• Legal Representative: Wang Haochen
• Registered / Operating Address: Room 2501, 25/F, Unit 1, Building 5, Yard 66 Zhengtong Road, Erqi District, Zhengzhou City, Henan Province, China
• Capacity: Welmo Technology is the "Personal Information Processor" of your personal information under this Policy (as defined in Article 73 of the PIPL).

1.2 Scope

This Policy applies to all Welmo Technology products and services, including:

• Websites: www.welmotech.com, spices.welmotech.com, thegreens.welmotech.com, pet.welmotech.com, admin.welmotech.com, and other subdomains we may launch in the future;
• WeChat Mini-Program: "Welmo Perks" (未陌惠).

If new product lines launched in the future (including new businesses under "WelmoSelect / 未陌精选") involve personal information processing beyond the scope of this Policy, we will provide additional notice and obtain your consent.

1.3 Key Terms

2. How We Collect and Use Your Personal Information

We collect personal information only to the extent necessary to provide our products or services, and we adhere to the principle of data minimization. Detailed fields, purposes, and retention periods are set out in the Personal Information Collection List (Document 03).

2.1 Registration and Login Information

2.2 Benefit Activation and Fulfillment Information

2.3 Uploaded Images and Videos

Images and videos uploaded to the Service may contain sensitive personal information including portraits, biometric features, and family environments of you and others. We will process such information with the highest degree of care.

About marketing use of trial videos: Whether to authorize Welmo Technology to use your trial video in marketing is decided via an independent checkbox in the Mini-Program. This checkbox is independent of overall consent to this Privacy Policy and may be revoked at any time. See Document 06.

2.4 Cookies and Log Information (Website Only)

Detailed technical information is in Document 08.

Important:

• The "Welmo Perks" Mini-Program does not use Cookies; login state is maintained via WeChat native Storage and JWT;
• We do not deploy any third-party analytics, tracking, advertising, or crash-monitoring SDKs on the website or Mini-Program, including but not limited to Google Analytics, Mixpanel, Sentry, Umeng, Sensors Data, TalkingData, ByteDance Analytics, JPush, etc.

2.5 Device and Diagnostic Information

Welmo Technology does not actively collect the following:

• IMEI, IDFA, IDFV, Android ID, device serial numbers, or other unique device identifiers;
• Your precise geolocation (GPS/GNSS);
• Your contacts, photo album, microphone, calendar, or SMS content;
• Lists of other applications installed on your device.

We only access your photo album temporarily through the standard APIs of WeChat Mini-Program or the browser when you actively invoke a related feature (e.g., selecting a local photo to upload to LumaPet). Album access permissions terminate as soon as the upload completes.

2.6 Information Received from Third Parties

We do not actively obtain your information from third-party data brokers or public data sources. However, we receive information from partners in the following scenarios:

• WeChat: When you choose WeChat login, WeChat returns your OpenID and UnionID for identification. We do not receive your WeChat nickname, avatar, location, or other information.
• External e-commerce platforms: In rare fulfillment exception cases, Welmo Technology or logistics partners may obtain order status and tracking numbers from external e-commerce platforms.

3. How We Use Cookies and Similar Technologies

3.1 Summary

Welmo Technology uses cookies only on the website, and only to maintain login state and necessary frontend display. We do not use any third-party tracking or advertising cookies.

3.2 Cookies Used

For full details, see the Cookie & Local Storage Notice (Document 08).

3.3 How to Disable

You may clear or reject cookies in your browser settings, but doing so will prevent you from maintaining login state on the website and may affect normal use of the Service.

4. How We Share, Transfer, and Disclose Your Personal Information

4.1 Sharing Principles

Welmo Technology does not sell your personal information to any third party. We share your personal information only in the following circumstances:

1. With your consent: To the extent and to whom you have consented;
2. Statutory obligations: As required by laws, regulations, supervisory orders, or judicial mandates;
3. Contract necessity: To complete the fulfillment of benefits you have purchased;
4. Protection of rights: When necessary to protect the life or property safety of you or others in emergency situations.

4.2 Sharing Scenarios and Recipients

The complete list, including links to each third party's privacy policy, is in the Third-Party Sharing List (Document 04).

4.3 Transfer

Welmo Technology will not transfer your personal information to any company, organization, or individual, except:

1. With your explicit consent;
2. In the event of merger, acquisition, asset transfer, or similar transactions, in which case we will require the new holder to continue to be bound by this Policy or to obtain your renewed consent.

4.4 Public Disclosure

Welmo Technology will not publicly disclose your personal information, except:

1. With your explicit consent;
2. As required by mandatory laws, administrative orders, or judicial demands.

5. How Your Personal Information Is Stored

5.1 Storage Location

• Business data: Stored in Alibaba Cloud RDS MySQL (Hong Kong node);
• User-uploaded images and videos: Stored in Alibaba Cloud OSS (oss-cn-hongkong node);
• Database backups: Stored in Alibaba Cloud OSS (Hong Kong node).

All of the above storage locations are outside the territory of mainland China (in the Hong Kong Special Administrative Region). This constitutes "cross-border provision of personal information" under Articles 38 and 39 of the PIPL. A dedicated notice is given in Section 6.

5.2 Retention Period

We retain your personal information only for the minimum period necessary to fulfill the purposes set out in this Policy:

• Account information: From registration until 90 days after account deletion;
• Benefit activation and fulfillment records: During the validity period of the benefit + 3 years thereafter (per Art. 31 of the E-Commerce Law on transaction records);
• Logistics and refill records: 3 years from each shipment date;
• Uploaded images and videos: During the validity period of the corresponding benefit (e.g., 3 years for LumaPet); cleared automatically or manually after the benefit ends;
• Server logs: 6 months (for security audit and troubleshooting);
• SMS verification codes: Auto-expire within 5 minutes;
• JWT login state: 7 days for users / 8 hours for administrators;
• OSS signed URLs: Valid for 2 hours per issuance.

After the retention period expires, we will delete or anonymize your personal information, except where laws and regulations require otherwise.

6. Cross-Border Transfer Notice and Separate Consent

This section is the special notice for "providing personal information overseas" required by Articles 38 and 39 of the PIPL. Please read it carefully.

6.1 Basic Information

6.2 Security Safeguards

• All data transmission is encrypted via TLS 1.2+;
• Database passwords are stored using the industry-standard bcrypt algorithm;
• OSS object access uses one-time signed URLs (default 2-hour expiry);
• Welmo Technology has signed service agreements and data processing addenda with Alibaba Cloud meeting regulatory requirements;
• Regular security self-assessments and vulnerability scans.

6.3 Separate Consent

Welmo Technology will obtain your "separate consent" for the foregoing cross-border transfer activities through a dedicated checkbox in the product when you first activate a benefit or upload content. If you do not consent, you will not be able to continue using the Service.

6.4 Legal Basis

• PIPL Article 38: Cross-border transfer via standard contract / certified safety assessment / separate consent;
• PIPL Article 39: Obtaining the individual's separate consent.

When Welmo Technology's user base reaches a certain scale, we will file a security assessment or standard contract with the Cyberspace Administration of China in accordance with the Measures for Security Assessment of Outbound Data Transfers and the Measures for Standard Contracts for Outbound Personal Information.

7. How We Protect Your Personal Information

7.1 Technical Measures

• Transport encryption: HTTPS (TLS 1.2+) platform-wide; certificates auto-renewed via Let's Encrypt;
• Storage encryption: User passwords stored using bcrypt; database and OSS storage encryption enabled by default through cloud provider;
• Access control: Production environment access is limited to authorized personnel via bastion host; admin panel requires two-factor authentication (mobile + password + SMS);
• Signed URLs: User-uploaded images and videos are accessed via OSS one-time signed URLs (default 2-hour expiry);
• Rate limiting: IP-based token bucket (auth endpoints 10 req/min, business endpoints 60 req/min);
• Security headers: Responses include X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, Referrer-Policy: strict-origin-when-cross-origin;
• Crawler protection: robots.txt blocks /api/, /*/login, /*/register, /*/user; API responses include X-Robots-Tag: noindex, nofollow.

7.2 Management Measures

• A Personal Information Protection Officer is appointed to oversee personal information security and compliance;
• Regular personal information protection training for all employees;
• Critical operations (e.g., admin write actions on user data) are logged in audit trails retained for 3+ years;
• Data processing agreements signed with third-party partners requiring equivalent security levels.

7.3 Incident Response

In the event of (or potential for) a personal information breach, alteration, or loss, we will:

1. Immediately activate our incident response plan to contain the impact;
2. Within 72 hours, notify affected users of the incident details, potential consequences, and mitigation actions taken via push notification, SMS, or email;
3. Simultaneously report to local cybersecurity, public security, or other regulatory authorities and cooperate with investigations;
4. After the incident is resolved, archive and conduct a post-mortem review.

8. Your Rights

Pursuant to Articles 44–50 of the PIPL, you have the following rights regarding your personal information:

8.1 Right to Be Informed and to Decide

You have the right to know how we process your personal information and to make decisions about it, including consent, withdrawal of consent, and limitations on processing.

8.2 Right of Access and Copy

You may:

• View your registration information, bound mobile number, and benefit/order records on the Mini-Program "Profile" page or the website "Account Settings" page;
• Email legal@welmotech.com to request access or a copy of your complete personal information.

We will respond within 15 business days of receiving a complete request.

8.3 Right to Correction and Supplementation

If you find errors or incompleteness in the personal information we hold about you, you may:

• Self-edit fields such as nickname in the Mini-Program / website profile center;
• For fields that cannot be self-edited (e.g., mobile number), submit a correction request to legal@welmotech.com; we will process after verifying your identity.

8.4 Right to Deletion

You may request deletion of your personal information when:

• The processing purpose is achieved, cannot be achieved, or is no longer necessary;
• We stop providing the product or service, or the retention period expires;
• You withdraw consent;
• We process personal information in violation of laws, regulations, or agreements;
• Other circumstances provided by laws and regulations.

Please send deletion requests to legal@welmotech.com. We will process within 15 business days after verifying your identity. For account deletion procedures, see Document 09.

8.5 Right to Data Portability

If conditions set by the Cyberspace Administration of China are met, you may request that we transfer your personal information to another personal information processor of your choice. Please submit requests to legal@welmotech.com.

8.6 Right to Withdraw Consent

For processing based on your consent, you may withdraw consent at any time. However, please understand that withdrawal does not affect the validity of processing carried out before withdrawal, nor does it affect processing required by law or necessary for contract performance.

8.7 Right to Explanation

You have the right to request that we explain the rules of this Policy and our personal information processing.

8.8 Complaints and Reports

If you believe our processing has infringed your lawful rights, you may:

• Complain to us via legal@welmotech.com;
• File complaints with local cybersecurity, MIIT, or public security authorities;
• File a lawsuit with a competent People's Court.

9. Protection of Minors

9.1 Target Audience

Welmo Technology's services are primarily designed for adults with full civil capacity. Welmo Technology does not actively collect personal information of minors.

9.2 Children Under 14

If you are a child under 14 years of age, please do not register or use the Service on your own. If use is necessary, your parent or other guardian shall handle it on your behalf.

9.3 Minors Aged 14–18

If you are a minor aged 14 to 18, you should use the Service only with the consent and supervision of your guardian. Your guardian may exercise the rights under this Policy on your behalf.

9.4 Discovery and Handling

If we discover that we have collected personal information from a minor without prior verifiable consent of the guardian, we will take steps to delete the data as soon as possible.

For detailed rules, see the Minors Personal Information Protection Rules (Document 07).

10. Policy Updates and Notifications

10.1 Amendments

Welmo Technology may amend this Policy in response to legal changes, business development, or compliance requirements. Amendments will be notified through one of the following:

• Prominent announcement on the website;
• Push notification within the Mini-Program;
• SMS or email for material changes.

10.2 Material Changes

For changes affecting your significant rights, we will give prominent notice and request your renewed consent:

• Material changes to our service mode (e.g., changes in personal information processing purposes, types, or methods);
• Changes in control (e.g., M&A causing ownership changes);
• Material changes in main recipients of personal information sharing, transfer, or disclosure;
• Material changes in your rights and how to exercise them;
• Changes in the responsible department, contact, or complaint channels for personal information security;
• When a personal information protection impact assessment indicates high risk.

10.3 Historical Versions

Historical versions of this Policy are archived in Welmo Technology's GitHub repository at welmo-agreements/archive/. Please contact legal@welmotech.com to request access.

11. Contact Us

11.1 Contact Information

• Company Name: Henan Welmo Technology Co., Ltd.
• Registered / Operating Address: Room 2501, 25/F, Unit 1, Building 5, Yard 66 Zhengtong Road, Erqi District, Zhengzhou City, Henan Province, China
• Customer Service Phone: +86 158 3825 5257 (Daily except Wednesdays, 09:00–18:00 China Standard Time)
• Customer Support Email: support@welmotech.com
• Personal Information Protection Officer Email: legal@welmotech.com
• Mini-Program ICP Filing Number: 豫ICP备2026007805号-1X

11.2 Personal Information Protection Officer

Welmo Technology has appointed a Personal Information Protection Officer to oversee personal information processing activities and protective measures. For any question, comment, suggestion, or complaint about this Policy or your personal information, please contact us at legal@welmotech.com. We will respond within 15 business days.

11.3 Regulatory Complaint Channels

• Cyberspace Administration of China Reporting Center: 12377
• Ministry of Industry and Information Technology Complaints: 12300
• National 12315 Platform (Consumer Complaints): 12315

12. Appendices

Revision History

All rights of final interpretation reserved by Henan Welmo Technology Co., Ltd.

Document ID: WELMO-LEGAL-02 · Version v1.0 · April 7, 2026