Privacy Notice

Shanghai Zhongyan Information Technology Co., Ltd. (上海中彦信息科技有限公司) is responsible for the personal information described here. It is registered in People's Republic of China under Unified Social Credit Code (PRC company registration and tax identifier): 913102306678110986; its legal representative is Ge Yongchang (葛永昌).

Registered address: Room 106-2, Building 25, No. 2111 Beiyan Road, Chongming District, Shanghai, China (上海市崇明区北沿公路2111号25幢106室-2（崇明森林旅游园区）). Business and service address: No. 1, Lane 200, Longcao Road, Xuhui District, Shanghai, China (上海市徐汇区龙漕路200弄乙字1号). Privacy requests may be sent to service@en.fanli.com.

For email registration, Fanli processes your email address, display name and a one-way hash derived from your password; it does not store the password itself. If you register or sign in with Google, Fanli receives the Google account identifier and issuer, email address and verification status, display name and, when available, a profile-image URL. Fanli does not request access to Gmail, contacts or Google Drive.

Fanli records your selected country site and locale and the version, action, source and time of the User Terms acceptance, Privacy Notice presentation and age confirmation. Those legal records do not contain a date of birth, raw IP address, user agent, OAuth token or cookie.

When you select GoShop, Fanli creates a pseudonymous member identifier and a unique click identifier with country-site, store, offer and destination snapshots. Those identifiers are sent to the affiliate-link service so that partner-reported order identifiers, amounts, currencies, statuses and timestamps can later be matched and used to administer cashback.

For application-level abuse prevention, Fanli uses short-lived HMAC-derived identifiers. The application rate-limit store does not retain the raw IP address or raw email address in those identifiers, and the counters expire after 15 minutes. Support and withdrawal information is created only when you use those features.

We use this information to create and secure accounts, provide requested services, attribute purchases, administer cashback and withdrawals, prevent abuse, answer requests, maintain accounting and dispute records and comply with law.

Account and confirmation fields marked as required are needed to create or secure an account. Without them, Fanli cannot complete registration, sign-in or the requested account feature.

Fanli does not use optional marketing, profiling or non-essential browser tracking. Before introducing any such purpose, Fanli will update this notice and provide the choices required by applicable law.

Depending on the purpose, processing relies on taking steps at your request or performing our contract, complying with legal obligations, or legitimate interests in security, fraud prevention, service operation and legal claims. Any consent-based activity will be offered separately and can be withdrawn.

We do not use the registration checkboxes as consent for optional marketing or tracking, and Fanli does not use registration information for those purposes.

Account operation, GoShop, order attribution, cashback, withdrawals and support rely on contract performance or steps requested before a contract; security, abuse prevention and legal claims rely on legitimate interests; tax, accounting and authority requests rely on legal obligations.

If you use Google, identity information is exchanged with Google. Production verification email is designed to use AWS SES. GoShop sends the pseudonymous identifiers and routing data described above to the affiliate-link service and the selected store. Fanli also relies on application-hosting, managed MySQL and Redis, security and content-delivery providers. The web application has no direct bank API or automated payment processor; approved withdrawals are handled through a separate finance process.

Stores and affiliate networks receive or create information connected with the relevant shopping journey under their own roles and notices. Processing is directed by the controller in China; other recipients may operate in China, the United States or other countries. Fanli limits disclosures to the information needed for the stated purpose.

Where UK data-protection law requires a restricted-transfer mechanism or additional safeguards, Fanli uses the required mechanism and provides further information on request.

Google OAuth security data and email-verification codes expire after ten minutes; application rate-limit counters expire after 15 minutes. User sessions expire after seven days by default and may be configured from five minutes to 30 days; staff sessions expire after no more than eight hours.

Account data is kept while the account is active and afterwards only while open orders, cashback, withdrawals, complaints, security matters or legal duties require it. Click, order, cashback, withdrawal, support, tax, accounting, legal-acceptance and audit records are kept for the applicable statutory period or until a dispute is resolved. They are then deleted or anonymised unless another lawful basis requires retention.

Fanli uses technical and organisational measures intended to protect accounts and records against unauthorised access, alteration or loss. No service can promise absolute security; material incidents are handled under the applicable requirements.

Contact service@en.fanli.com to exercise applicable UK GDPR rights, including access, correction, erasure, restriction, portability, objection or withdrawal of consent. You may use the same privacy contact to raise a data-protection complaint. Fanli will acknowledge that complaint within 30 days, investigate it without undue delay, keep you informed as appropriate and tell you the outcome. You may also complain to the Information Commissioner's Office.

Request account deletion in the App under Account > Delete account or at https://mars-fanli.fanli.com/account-deletion. After confirmation, access and sign-in information are removed; only transaction, tax, accounting, security, legal-acceptance and dispute records required for a stated purpose remain subject to restricted retention.

Fanli may request proportionate information to verify a request. We will explain when a request cannot be fulfilled in full and identify any available complaint or appeal route.

Fanli uses automated matching to associate partner-reported orders with GoShop click identifiers and to update cashback status. Fanli is intended for adults aged 18 or over and does not make solely automated decisions that produce legal or similarly significant effects.

We update this notice when purposes, recipients, retention or legal requirements materially change. The version and effective date above identify the notice that applies.