What we collect, and what for

1. When we collect information

There are only two situations in which we collect your personal information:

• You fill in and submit a contact form (booking an assessment, an enquiry, and so on);
• You complete the export readiness assessment.

Both are initiated by you. If you do neither, we hold nothing that identifies you.

2. What we collect

When you submit a form we record:

• What you entered: name, phone or WeChat ID, company, business type, areas of interest, and your message;
• Context: the page you submitted from, its language, and the time of submission;
• Source: the campaign parameters (UTM), referring site and landing page from your first visit, plus the source of this particular visit;
• Technical data: IP address, browser user agent, and a visitor identifier we store in your browser (see section 5).

When you complete the assessment we record: your full set of answers and score, the stage it produced and the guidance shown at the time, source information, and the visitor identifier.

Assessment records are deliberately minimised: we do not store your raw IP address or full user agent — only an irreversible hash (used to spot abnormal repeat submissions) and a coarse device type (mobile / tablet / desktop). If you took the assessment without submitting a form, that record contains nothing that can be used to contact you.

3. What we use it for

• To contact you and respond to your enquiry or assessment;
• To understand which channels actually produce real enquiries, so we can adjust our own marketing;
• To study the overall distribution of assessment results and improve our content;
• To detect abnormal submissions such as bots and duplicates.

We do not use your information for anything outside this policy. We do not sell it, and we do not use it for automated decision-making or profiling-based advertising.

4. Who has access

• Our own team members responsible for follow-up, through the website admin;
• WeChat Work: when you submit a form we send an internal notification through a Tencent WeChat Work group bot, which includes the contact details you entered. This transfers data to Tencent and is governed by their own privacy terms;
• Our hosting provider: the website and database run on servers we rent.

Beyond the above we do not disclose your personal information to any third party, except where required by law or with your separate consent.

5. Cookies and the visitor identifier

We store a small amount of first-party data in your browser. None of it is used for cross-site tracking:

• Visitor identifier (haitu_vid): a random number used to link "took the assessment" and "submitted a form later" as the same person. It contains no personal information and is meaningful only inside our own database;
• Source record: the campaign parameters and referring site from your first visit, kept in browser local storage and sent along when you submit a form.

We do not use third-party advertising cookies and are not connected to any data management platform. You can clear this data in your browser at any time without affecting the site.

6. How long we keep it

• Enquiries that did not convert, or were marked invalid: kept for 24 months from submission, then deleted from the database;
• Enquiries from people who became customers: not covered by that automatic clean-up, because we need them to maintain the relationship and fulfil our contract;
• Assessment records: kept long term as anonymous statistics; if one was linked to an enquiry, that link is broken and its hash cleared when the enquiry is deleted.

7. Your rights: access, correction and deletion

You can ask us at any time to:

• Tell you what information about you we hold;
• Correct anything that is inaccurate;
• Delete your personal information.

We act on such requests after verifying your identity, normally by confirming the phone number you submitted with. Deletion permanently removes the enquiry and its follow-up notes from the database and cannot be undone; the related assessment record is kept but reduced to anonymous statistics.

So that we can demonstrate the deletion actually happened, our operation log records that an enquiry was deleted at a given time — but the log holds neither your name nor your contact details.

8. How we protect it

• The whole site is served over HTTPS;
• The admin requires a login, and passwords are stored irreversibly (scrypt with a random salt) — we cannot read them either;
• The website database is entirely separate from the door and window management system's database, with separate credentials;
• Key admin actions (login, edit, delete) are written to an operation log.

No system can be guaranteed absolutely secure. If a breach occurs that could affect you, we will notify you as soon as we can using the contact details you provided.

9. Minors

This site is aimed at businesses in the door and window industry, not at minors, and we do not knowingly collect information from them. If you believe we have, please contact us and we will delete it.

10. Changes to this policy

If we make material changes we will update the date at the top of this page. Please review the current version before submitting information again.