Privacy Policy

1. Overview

Suzhou Chivox Information Technology Co., Ltd. ("Chivox", "we", or "us") values privacy and data security. This Privacy Policy explains how we collect, use, store, share, and protect personal information and business data when you use the Chivox MCP website, console, APIs, SDKs, documentation, and related services. If you have a separate agreement, order, or data processing agreement with Chivox, that document governs the relevant data processing arrangements; matters not covered by it are governed by this policy.

2. Information We Collect

• Account and contact information: Name, company, title, email, phone number, and credential-related information provided during registration, trial, inquiry, or business communication;
• Service usage data: API call logs, request volume, concurrency, error logs, billing records, tickets, operation logs, and security audit logs;
• Device and network information: Browser type, operating system, IP address, access time, page views, Cookie identifiers, and similar technical information;
• Assessment business data: Text, audio, task parameters, assessment results, diagnostic details, and necessary metadata submitted through APIs or SDKs;
• Sensitive personal information: In some scenarios, speech audio, voice-related features, minors' speech, or education assessment information may constitute sensitive personal information. You are responsible for obtaining separate consent, guardian consent, or another lawful basis where required.

3. Processing Roles and Customer Instructions

For business data that you submit, generate, process, or store in Chivox MCP, you are usually the controller or personal information processor responsible for determining processing purposes, processing methods, and compliance basis. Chivox usually acts as an entrusted processor or technology service provider and processes data according to your instructions, product functions, contracts, and applicable law. If the parties execute a data processing agreement, entrusted processing agreement, or order terms, those arrangements prevail.

4. How We Use Information

• Provide, maintain, and improve the Chivox MCP service;
• Process API requests and return assessment results;
• Manage accounts, authenticate users, control permissions, calculate usage, process billing, and provide technical support;
• Send service notices, product updates, billing information, security alerts, and technical support messages;
• Detect and prevent fraud, abuse, attacks, unauthorized access, or other security risks;
• Conduct algorithm training, model optimization, quality evaluation, and technical research where permitted by law, contract, and de-identification or anonymization requirements;
• Comply with legal obligations.

5. Sharing, Entrusted Processing, and Disclosure

We do not sell personal information. We may share, entrust processing of, or disclose information only where necessary and lawful, including with your or your organization's consent or authorization, with service providers for cloud infrastructure, messaging, payment, support, security audit, storage, or operations, when required by law, regulators, courts, or administrative authorities, or where reasonably necessary to protect the safety and lawful rights of Chivox, users, or the public. Service providers must follow confidentiality and data protection obligations.

6. Data Security

We use security measures appropriate to service risks, including HTTPS/TLS encryption, access controls, permission segregation, log auditing, key management, data isolation, backup and recovery, and security monitoring. Personnel and service providers with access to data are subject to confidentiality obligations. No internet environment is completely secure, and while we continuously improve our safeguards, no system can be guaranteed to be immune from attacks or failures.

7. Security Incident Response

If a personal information leak, alteration, loss, or other data security incident occurs or may occur, we will activate an emergency response plan as required by law and take containment, investigation, remediation, and notification measures. Where your business data or end users' personal information is involved, we will notify you within a reasonable period through contractual channels, console notices, email, or other feasible methods of the basic facts, potential impact, measures taken or planned, and risk reduction recommendations, and will cooperate with regulatory reporting or user notification where required by law.

8. Data Retention, Export, and Deletion

We retain information only for as long as necessary to achieve the purposes described in this policy, perform contracts, support audits and dispute resolution, or comply with legal requirements. Account, contract, order, billing, and audit records are retained during the service term and for statutory or reasonable retention periods. Assessment audio, text, results, and logs are retained and deleted according to product documentation, console settings, orders, or contracts; where no separate arrangement applies, we follow data minimization and do not retain raw audio on a long-term basis. De-identified or anonymized information that cannot identify a specific individual may be used for statistics, algorithm optimization, and technical research.

When the service terminates, an account is closed, or you submit a lawful deletion request, we will process data export, deletion, anonymization, or return according to law, product capabilities, and the parties' arrangements. Account closure or data deletion may be irreversible and may prevent you from retrieving historical call records, assessment results, bills, configurations, or business data. Please back up necessary data before taking such actions. Information required by law or necessary for settlement, audit, or dispute resolution will be retained for the necessary period and restricted in use.

9. Cross-Border Transfer and Storage

Unless product documentation, contracts, or applicable law provide otherwise, Chivox MCP related data is generally stored within the People's Republic of China. If cross-border transfer is involved due to your selected deployment region, third-party services, cross-border business collaboration, or legal compliance requirements, we will complete the necessary notices, assessments, contracts, certifications, or other procedures required by applicable law.

10. Cookies and Similar Technologies

We use necessary Cookies and similar technologies to maintain login sessions, protect security, remember preferences, and understand service usage. You may manage Cookies through your browser settings, but disabling necessary Cookies may affect login, console access, and some features.

11. Your Rights

Subject to applicable law, you may access, copy, correct, supplement, or delete personal information, change authorization scope, withdraw consent, close your account, request an explanation of personal information processing rules, or file complaints with competent authorities. Because Chivox MCP is commonly used in developer or enterprise customer scenarios, end users may also contact the customer that provides the relevant application or service; after verifying identity and authority, we will assist as required by law.

12. Minors

Chivox MCP is intended for developers and enterprise customers and does not actively provide independent registration services to minors. If your application or business scenario involves minors, especially children under the age of fourteen, you must obtain consent from their parents or other guardians and fulfill necessary notice and protection obligations. If we discover minors' information is processed without lawful authorization, we will take deletion, restriction, or other necessary measures according to law and contract.

13. Policy Updates

We may update this Privacy Policy due to changes in laws, product functions, data processing methods, or operational arrangements. For updates that materially affect personal information rights, we will provide notice through website announcements, console notices, email, or other reasonable methods. The updated policy takes effect on the date shown on this page or in the notice. If law requires renewed consent, we will handle it accordingly.