Privacy Policy

1. Introduction and scope

This Privacy Policy explains how Maitu Co., Limited ("Maitu", "we", "us") handles personal data when you visit mengtuyx.com (the "Website"), contact us, use our business services, or download and use the Maitu Mobile application published on the Apple App Store and Google Play (together, the "App").

It applies to every region in which the Website or the App is made available, and it supplements rather than replaces any separate agreement we hold with business clients. Where a client engagement requires more specific processing arrangements, those arrangements take precedence for that engagement.

Our business scope covers cross-border business advisory, logistics supporting consultation, brand planning, general trading and e-commerce consultation. Some of our App features exist to support those business lines, which is why the App processes the categories of data described in Section 2.

2. Data we collect

2.1 Account and contact data

When you create an App account or submit a message through our contact form, we collect your name, business email address, company name, and the content of your message. If you use an enterprise or team workspace, the administrator of that workspace may also provide your role, team and reporting line.

2.2 Device and technical data

We collect device model, operating system and app version, screen resolution, language settings, network and carrier information, crash and diagnostic data, and approximate timestamps of interactions.

2.3 Usage data

We record how you use the App and the Website: screens visited, features used, search terms entered, session duration, and the pages or documents you open on the Website. We use this to keep the service reliable and to improve workflows for orders, inventory, supply chain tracking, consulting dashboards, investment planning and trading operations.

2.4 Optional location data

Where you grant permission, the App may use precise or coarse location to support delivery tracking and field verification of consignments. Location is optional, is collected only with your consent, and is used at the level of precision you permit. You may decline or withdraw this permission at any time in your device settings.

2.5 Advertising identifiers and consent data

Where permitted and subject to your consent, we and our advertising partners collect advertising identifiers such as the IDFA (Apple) and AAID / Google Advertising ID (Android), together with consent signals recorded by our consent management platform, including any ATT (App Tracking Transparency) authorisation, TCF string, and US privacy opt-out flags.

2.6 Business enquiry records

Correspondence, proposals, engagement agreements and transaction records are retained as business records. Where you act for a company, we may also process business contact data about you that the company itself has provided to us.

3. How we use data

• To provide, operate, maintain and personalise the Website and the App.
• To authenticate accounts, manage workspaces, roles and permissions, and support multi-tenant business deployments.
• To process orders, manage inventory, track supply chains and deliver consulting and advisory deliverables.
• To plan brand and marketing activity, including market planning and campaign measurement.
• To operate wholesale, retail and e-commerce commerce flows on behalf of clients and in our own general trading activities.
• To respond to enquiries, deliver proposals and fulfil contractual commitments.
• To maintain security, prevent fraud and abuse, and enforce our Terms of Service.
• To personalise advertising and to measure advertising performance, where you have consented or where another lawful basis applies.
• To analyse product performance so we can improve reliability and feature quality.
• To comply with legal obligations, enforce our rights, and establish or defend legal claims.
• To send service communications about releases, maintenance windows and operational notices.

We do not sell your personal data for money. We do not use sensitive categories of personal data for advertising purposes, and we do not build profiles for the purpose of inferring characteristics that produce discriminatory outcomes.

4. Legal bases for processing

We rely on the following legal bases depending on your location and the processing activity. Where a consent-based basis is indicated, you may withdraw consent at any time without affecting the lawfulness of processing already carried out.

5. Sharing and processors

We share personal data only with the categories of recipients below.

• Processors and service providers — hosting and cloud infrastructure, content delivery, customer support, email delivery, analytics, crash reporting, consent management and security services, each bound by written data processing terms.
• Advertising partners — the networks and SDKs listed in Section 9, acting as independent controllers or as processors depending on the data and the configuration.
• App stores and operating system providers — Apple and Google, which process data under their own terms in connection with distribution, installation, billing, updates and integrity checks.
• Payment and billing providers — where subscriptions or purchases are handled through the App Store or Google Play, or through a payment service provider acting for us.
• Business partners and clients — where an engagement requires us to share information with a supplier, carrier, agent or partner to deliver the service, and only to the extent necessary.
• Professional advisers and authorities — auditors, lawyers, accountants, regulators and law enforcement, where required by law or necessary to protect our rights.
• Corporate transactions — in connection with a merger, reorganisation, financing or sale of assets, subject to appropriate confidentiality safeguards.

We maintain a current list of processors and sub-processors. Business clients with a signed agreement may request it through support@mengtuyx.com.

6. International transfers

Maitu is established in Hong Kong and works with clients and providers in many jurisdictions. Personal data may therefore be processed outside the jurisdiction in which it was collected, including in the United States, the European Economic Area, Mainland China, Singapore, India and other regions.

For transfers subject to GDPR or UK GDPR we rely on an adequacy decision where one exists, and otherwise on Standard Contractual Clauses together with the UK International Data Transfer Addendum, or on another transfer mechanism recognised by the relevant authority. Where the applicable regime requires it — including APPI in Japan and PIPA in South Korea — we maintain the required transfer documentation and supplementary measures such as access controls, encryption and transfer impact assessments.

7. Retention

We keep personal data only for as long as we need it for the purposes described in this policy.

8. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit using TLS and encryption at rest for stored business records, role-based access control with least-privilege permissions, multi-factor authentication for administrative access, environment separation between development, staging and production, logging and monitoring of access to personal data, regular vulnerability assessment and penetration testing, incident response and breach notification procedures, vendor security review before onboarding, and staff training on data protection obligations.

No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within the period required by the applicable law — including 72 hours under the GDPR — and will notify affected individuals where the applicable law requires it.

9. Advertising and monetisation

The App is supported by advertising. We integrate third-party advertising SDKs which may present advertisements and may collect or receive information such as your device identifiers, IP address, approximate location, user agent, app version, advertising interaction data and, where you have consented, information about your activity across other apps and websites.

Advertising is subject to your consent where required. Where consent is required, no personalised advertising is served before you grant it, and you may change your choice at any time from your device settings or through our in-app preferences.

We distinguish personalised advertising, which uses information about you — such as advertising identifiers, inferred interests and prior activity — to select advertisements, from non-personalised advertising, which is selected only using limited information such as country, device model, app version and coarse language, and is not linked to a persistent identifier.

We do not permit our advertising partners to use sensitive personal data for targeted advertising, and we require partners to honour Global Privacy Control and recognised opt-out signals.

9.1 Advertising partners, purposes and opt-out routes

The table below lists the advertising networks and SDK platforms integrated or available in the App, the purpose of the integration and the route to opt out.

9.2 Platform-specific identifier controls

• Apple ATT — on iOS, our App requests App Tracking Transparency authorisation before any tracking takes place. If you decline, ads remain contextual and non-personalised.
• IDFA — available only with your explicit ATT permission and reset by you at any time through Settings > Privacy > Advertising > Reset Advertising Identifier.
• AAID / Google Advertising ID — reset or deleted in Android Settings > Privacy > Ads, and removed when you uninstall the App.
• Limit Ad Tracking — enabling this on iOS signals that personalised advertising should be limited.

10. Ad formats and user controls

The App may present the following advertising formats.

You can reduce or remove advertising by subscribing to the paid tier, by disabling personalised advertising through the in-app privacy preferences, by resetting your device advertising identifier, or by enabling a system-level ad blocker or Limit Ad Tracking setting. You can also email support@mengtuyx.com to request that personalised advertising be disabled for your account.

11. Cookies and similar technologies

The Website uses cookies and similar technologies — including local storage, session storage, pixels and SDK identifiers — for the following purposes:

• Strictly necessary — maintaining your session, remembering your preferences, load balancing and security. These cannot be switched off without breaking the service.
• Functional — remembering choices such as language, region and dashboard layout.
• Analytics — aggregated measurement of pages visited and journeys taken, used to improve the site.
• Advertising — measuring campaigns and limiting repeated ad exposure. These remain inactive unless you consent where consent is required.

You can manage cookies through your browser settings and through the consent banner presented on your first visit. Blocking strictly necessary cookies will prevent certain Website features from working correctly.

12. Your rights by region

Subject to the law that applies to you, you may hold the rights listed below. To exercise any of them, email support@mengtuyx.com with the subject line "Privacy request" and describe your request. We respond within the period required by the applicable law — normally 30 days, extendable to 60 days for complex requests with notice.

You may also lodge a complaint with your local supervisory authority. We would appreciate the opportunity to resolve the matter with you directly first, so please contact us before escalating.

13. Children's privacy and age policy

The App and the Website are not directed to children. We do not knowingly collect personal data from anyone under the age of 13, and we do not knowingly collect data from users aged 13, 14 or 15 without verifiable parental consent, or from users under 16 where the applicable law requires a higher threshold.

• COPPA — we comply with the Children's Online Privacy Protection Act and its 2025 amendments. We do not knowingly collect data from children under 13, we verify parental consent where it is required, and we delete data we learn was collected from a child without valid consent.
• GDPR for children — where consent is the legal basis and the information subject is below the age of majority in their jurisdiction (16 in the EEA by default, with member states permitted to lower it to 13), we seek parental authorisation.
• App store age ratings — the App carries an age rating appropriate to its content, and we configure the advertising SDKs to exclude known users below the applicable threshold from interest-based advertising.
• No behavioural advertising to children — we do not serve personalised advertising to known minors, and we do not knowingly collect data for that purpose from users we know to be minors.

If you believe a child has provided us with personal data, email support@mengtuyx.com and we will delete it promptly.

14. App store compliance

14.1 Apple App Store

The App is developed and distributed in line with the Apple App Store Review Guidelines. It requests permissions only when the corresponding feature requires them, the privacy label accurately describes our data practices, and tracking is limited strictly to what has been authorised through App Tracking Transparency. We comply with Apple's Privacy Policy and App Privacy requirements and the terms of the Apple Developer Program License Agreement.

14.2 Google Play

The App is published on Google Play in line with the Google Play Developer Policy and the Data safety section of the Play Console, and our declared practices match what the App actually does. The App is configured for the Families category requirements where applicable, including child-directed advertising restrictions, and complies with Families Policy and Designed for Families guidelines.

14.3 User controls we ship

• An in-app privacy preferences panel for consent withdrawal and advertising control.
• Account deletion within the App, which triggers deletion of associated personal data from our production systems.
• Data export from the App for account and workspace administrators.

15. Do Not Track and Global Privacy Control

Legacy "Do Not Track" signals are not standardised, and we respond to them in line with applicable law. Global Privacy Control is recognised and honoured: where your browser or device sends a GPC signal, we treat it as a valid request to opt out of sale and sharing for that browser, we suppress personalised advertising and stop sharing data with advertising partners for that session, and we propagate the signal through our consent platform to our partners.

16. Changes to this policy

We review this policy at least annually and whenever our processing changes materially. When we make a significant change we will update the effective date below, post a notice on the Website and, where the change is material and we have a valid channel, notify you by email or in the App before the change takes effect. We keep a record of the previous versions for the periods set out in Section 7.

17. How to contact us

If you have any question about this policy, or wish to exercise a right, contact us using the details below. We aim to acknowledge every request within two business days.

• Business support: support@mengtuyx.com
• Key accounts: laiheng@mengtuyx.com
• Company: Maitu Co., Limited
• Office: ROOM C19 12/F, TUNGTEX BUILDING, NO. 203 WAI YIP STREET, KWUN TONG, HONG KONG
• Website: mengtuyx.com

If you are a business client and your enquiry relates to processing under a signed data processing agreement, please quote your agreement reference in your message so it can be routed correctly.

18. Effective date

Effective date: 6 November 2026 — this policy applies from the date shown here. The previous version, and the date on which it was replaced, will be available on request.