PRIVACY

SKUStage Privacy Policy

This policy explains what SKUStage needs to generate product imagery, localize an ad, sign you in and take payment—and how you can control or delete that data.

Effective date: 2026-07-27
Data controller: kxAI (operated by the registered owner of bamboochat.cn)
Privacy contact: baoboochat@gmail.com

1. Scope and data controller

This policy applies to https://kx.bamboochat.cn, the SKUStage global service, the kxAI China service and related clients that share the same account workspace. The data controller is kxAI (operated by the registered owner of bamboochat.cn). Contact baoboochat@gmail.com with privacy questions or requests.

We process personal data only when it is necessary to provide product-image generation, ad translation and layout rebuilding, account, security and payment services.

2. Data we process and why

Account data: email address, password hash, Google subject identifier, and the name or profile image Google shares with your permission. We use this data to register, authenticate and synchronize your workspace.
Workspace content: product photos, ad images, filenames, target markets, languages, creative notes, protected terms and generated results. We process it to complete image-generation and localization tasks you request.
Transaction data: plan, amount, currency, order number, payment provider, payment status and subscription identifiers. We do not store complete card numbers or payment passwords.
Technical data: IP address, request time, browser language, error logs, verification-code records and essential cookies. We use it for security, troubleshooting, authentication and default regional pricing.
Support data: messages and attachments you choose to send us, used to answer requests and resolve disputes.

3. Google user data

Google sign-in requests only the openid, email and profile scopes. We receive a Google subject identifier, verified email address and, when available, name and profile image.

SKUStage does not read Gmail, Drive, Calendar, Contacts or other Google product content. We do not persist Google access tokens or refresh tokens. Google user data is not sold, used for advertising, or shared for unrelated purposes.

You may revoke SKUStage in your Google Account permissions and may ask us to delete the account and linked Google identity data.

4. Processors and sharing

We do not sell personal data. We use service providers only as needed to deliver a feature you request.

Alibaba Cloud OSS and model services store product and ad assets and process image generation, visual text understanding, translation and layout rebuilding.
Google provides identity verification and Google sign-in.
WeChat Pay and Stripe process domestic and international checkout, taxes and refunds.
Resend sends verification codes and requested report emails when email delivery is enabled.
country.is or country headers supplied by our hosting edge may be used to infer a coarse pricing region from an IP address. We do not use this for precise location or ad profiling.
We may disclose information when lawfully required or when necessary to protect users, the service or the public.

5. International transfers

Google, Stripe, Resend and network infrastructure providers may process data outside your country. Transfers occur only when you use the related sign-in, checkout or email feature, or when necessary to operate the global service.

We minimize transferred data and use contractual, access-control and encryption safeguards appropriate to the processing.

6. Cookies and local storage

kxai_session is an HttpOnly authentication cookie kept for up to 400 days while the account remains active and removed when you sign out.
kxai_google_oauth stores short-lived state and nonce values for up to 10 minutes and is deleted after the callback.
kxai_market remembers your regional pricing choice for up to one year.
Local storage may retain language, interface preferences, PWA settings or unfinished image-workspace drafts that have not been uploaded.
We currently do not use advertising cookies. We will update this policy and request consent where required before introducing non-essential tracking.

7. Retention and deletion

Account data, uploaded product and ad assets, tasks and generated results remain until you delete them or close the account. Deleting a task removes its database record and related object-storage files, subject to reasonable backup and cache expiry.
Verification codes expire after 10 minutes; rate-limit records containing email and IP data are cleaned within 24 hours. OAuth attempt data expires after 10 minutes.
Order and finance records are retained for the minimum period required for tax, accounting, fraud prevention and dispute resolution.

8. Your rights

You may view, edit and delete workspace tasks and assets in the product. Email baoboochat@gmail.com to request access, correction, export, restriction, withdrawal of consent or account deletion. We may verify account ownership before acting.

Withdrawing consent does not affect processing already completed lawfully. You may also complain to the data-protection authority that has jurisdiction where you live.

9. Children

SKUStage is not directed to children under 14. Users under 18 should use the service only with a parent or guardian's review and consent. If we learn that child data was processed without valid consent, we will stop and delete it.

10. Security and changes

We use HTTPS, access controls, signed sessions, password hashing, short-lived signed URLs and least-privilege credentials. No system can guarantee absolute security, so do not upload data you are not authorized to process.

Material changes will be announced prominently and, where required, presented for renewed consent. The effective date above identifies the current version.