Waterspo Bridge Privacy Policy

1. Data Controller

The data controller of this Service is:

• Operator: Guangzhou Haizhu Waterspo Software Development Studio (Individual Business)
• Registered address: Online operation (no fixed physical business premises)
• Privacy contact email: privacy@waterspo.top
• Privacy officer: Handled by the operator personally (contact privacy@waterspo.top)

If you have any questions about this Policy or our processing of your personal information, you may contact us through the channels above.

2. Personal Information We Collect

2.1 Information you provide voluntarily

• Account information: name, email address, password (stored in encrypted form), and avatar (optional);
• Payment information: transaction amount, payment status, and transaction records. We do not store your full card number — payment card data is processed by the PCI-DSS compliant payment processor Whop;
• API key information: API Keys you create on our Platform (stored only in hashed form; the raw key is displayed only once);
• Communication records: customer support inquiries, feedback, and support requests you submit to us by email or ticket.

2.2 Information collected automatically

• Device and network information: IP address, device model, operating system, browser type, and time zone;
• Location information: approximate geographic location inferred from your IP address (country/region level, provided by the Cloudflare edge network);
• Usage behavior: page visits, feature usage, API call records (models called, token usage, response times, request logs), operation logs, and session duration;
• Log data: request time, error logs, and performance data.

Note on API content: The Platform only records token usage data returned by upstream AI providers for billing purposes. We do not store the content of your prompts or the content of model responses. Prompts and responses are processed only in memory during API calls (i.e., ephemeral forwarding) and are not written to persistent storage.

2.3 Scope of collection

The above information is collected only to the extent necessary to provide the Service. We do not collect personal information unrelated to the Service.

3. How We Use Your Personal Information

We may aggregate or de-identify personal information for statistical analysis, product improvement, and similar purposes. Information that has been de-identified and can no longer identify a specific individual is no longer considered personal information and may be used freely.

4. Cookies and Tracking Technologies

This Platform uses cookies and similar technologies to ensure the Service runs and to improve your experience:

Analytics tool used: Cloudflare Web Analytics (see its privacy policy at https://www.cloudflare.com/privacypolicy/). You may adjust cookie preferences through your browser settings, but disabling strictly necessary cookies will prevent certain functions from working properly.

5. Sharing and Disclosure of Personal Information

Core statement: We do not sell your personal information (including any "sale" as defined by the California Consumer Privacy Act (CCPA)), nor do we exchange your personal information for value.

We may share your personal information only in the following circumstances:

• Service providers: cloud computing (Cloudflare), payment processing (Whop), and analytics vendors used to provide the Service, all bound by confidentiality or data processing agreements, and may use your personal information only to the extent necessary to provide services to us. Payment card data is exclusively processed by the PCI-DSS compliant payment processor Whop and is not stored on our servers;
• Business partners: we currently do not share your personal information with any business partners (if we engage partners in the future, we will update this Policy in advance and obtain your consent);
• Legal and regulatory requirements: disclosure in accordance with law, court orders, or legitimate requests from regulatory authorities;
• Business transactions: in the event of merger, acquisition, or asset restructuring, we will notify you in advance via platform announcement or email before the change takes effect and ensure the receiving party continues to fulfill the protection obligations under this Policy;
• With your consent: for other specific purposes after obtaining your explicit prior consent.

6. Data Security Measures

We protect your personal information using the following security measures consistent with industry standards:

• Transmission encryption: TLS / HTTPS encryption across the entire website;
• Storage security: sensitive data such as passwords is stored using encryption or hashing; API Keys are stored only in hashed form;
• Access control: the principle of least privilege is followed; only authorized personnel may access data when necessary for their duties, and employees sign confidentiality agreements;
• Security auditing: regular security audits, vulnerability scans, and dependency security checks;
• Infrastructure security: the Service is deployed on the Cloudflare edge network, leveraging its DDoS protection and Web Application Firewall (WAF) capabilities.

In the event of a security incident involving your personal information, we will notify you and the relevant supervisory authorities within 72 hours of discovery in accordance with law and take necessary remedial measures.

7. Retention Period of Personal Information

Where a specific law or regulation requires a longer retention period, the law requirement shall prevail.

8. Your Data Rights

Under applicable data protection laws, you have the following rights. We will respond to your request within 30 calendar days:

You may exercise the above rights in the following ways:

• View or correct certain information yourself on the "Profile" page of your account;
• Submit a rights request by email to privacy@waterspo.top (we may require necessary identity verification information to confirm your identity);
• Delete your account through account settings; after deletion, your personal information will be handled in accordance with Section 7.

If you believe that our processing of your personal information has not been handled properly, you have the right to lodge a complaint with the data protection supervisory authority in your location.

9. Marketing Communications and Opt-out

We send product introductions, promotional offers, and other marketing information only after obtaining your explicit consent. You may opt out of marketing communications at any time by:

• clicking the "Unsubscribe" link in a marketing email;
• disabling marketing notifications in your account settings;
• contacting us by email at privacy@waterspo.top.

Please note: opting out of marketing communications does not affect your receipt of service-required notices (such as billing reminders, security alerts, and policy or Terms change notices), which are necessary to provide the Service.

10. Cross-Border Data Transfers

This Platform is deployed on the Cloudflare global edge network. Your personal information may be transferred to servers outside your country/region (including but not limited to the United States, Europe, and other Cloudflare node locations) for processing. To safeguard your personal information during cross-border transfers, we take the following measures:

• enter into data processing agreements that include the EU Standard Contractual Clauses (SCC) with relevant service providers;
• transfer your personal information only to recipients with equivalent or higher levels of protection;
• rely on Cloudflare's internationally certified security framework (including GDPR, SOC 2, and others; see https://www.cloudflare.com/trust-hub/).

11. Protection of Minors

This Service is intended for users aged 18 years or older (consistent with Section 1 of the Terms of Service). We do not knowingly collect personal information from minors under the age of 18. If you are a parent or guardian and discover that your child has provided personal information to us, please contact us immediately at privacy@waterspo.top, and we will delete the relevant information as soon as possible after verification.

12. Third-Party Links and Services

This Policy applies only to personal information we directly collect and process. This Platform may contain links to third-party websites or services. We are not responsible for the data practices of such third-party websites or services. We recommend that you review the privacy policies of such third-party websites or services before visiting or using them.

13. Changes to This Policy

We may update this Policy from time to time. For material changes (including material changes to the scope of collection, purposes of use, sharing recipients, or retention periods), we will notify you at least 15 days in advance via platform announcement or your registered email, and update the "Last Updated" date at the top of this page. The revised Policy applies from the effective date stated in the notice, and your continued use of the Service constitutes acceptance of the revised Policy.

We recommend that you periodically review this Policy to stay informed about how we protect your information.

14. Contact Us

If you have any questions, comments, or requests regarding this Policy or our processing of your personal information, please contact us through the following channels: