# Privacy Policy [Source](https://anysearch.com/legal?type=privacy) # AnySearch Privacy Policy > **Version**: v1.3 > **Publication Date**: OCT 28, 2026 > **Effective Date**: OCT 28, 2026 --- **IMPORTANT NOTICE: We deeply understand the importance of your Personal Data and will do our utmost to protect its security. We are committed to maintaining your trust in us and adhere to the following principles to protect your personal information: consistency of rights and responsibilities, clear purpose, choice and consent, minimum necessity, ensuring security, subject participation, and openness and transparency.** **Before using AnySearch services, please read and fully understand the entire content of this Privacy Policy (hereinafter referred to as "this Policy"). Clauses closely related to your rights and interests have been highlighted in bold for your attention.** ## Table of Contents - **I. Scope of This Policy** - **II. How We Collect and Use Your Personal Data** - **III. User Business Data** - **IV. How We Use Cookies and Similar Technologies** - **V. How We Share, Entrust Processing, Transfer, and Publicly Disclose Your Personal Data** - **VI. How We Store and Protect Your Personal Data** - **VII. How You Can Manage Your Personal Data** - **VIII. Protection of Minors' Personal Data** - **IX. Updates to This Policy** - **X. How to Contact Us** - **Appendix: Definitions** --- ## I. SCOPE OF THIS POLICY 1.1 This policy applies to the collection, use, storage, disclosure, entrusted processing, transfer and protection of personal data by Any Limited (hereinafter referred to as “we”) when providing services to you via the official AnySearch website (anysearch.com), API interfaces, Skills, MCP service endpoints, the management console and related tools. This Policy also applies to free services, the Personal Pro paid service and other paid packages, as well as related activities such as purchases, subscription management, renewals, cancellations, refunds and customer support. “Zero Tracking (No Tracking / No Telemetry / No Logging)” refers solely to the fact that, whilst providing core functionality, the AnySearch Skill and MCP services do not engage in advertising tracking based on user behaviour, cross-site analytical tracking, or telemetry reporting for user profiling, nor do they retain complete query content for the purpose of identifying users. This statement does not imply that we do not process account information, subscription status or necessary security, billing and service operation logs, nor does it apply to the official website, marketing pages, the Management Console or payment pages. When the aforementioned pages utilise analytics or advertising conversion tools, they comply with Section 4 of this Policy and the ‘Cookie Policy’. 1.2 With regard to third-party websites, payment services or other independent services that you access or use directly, the third party will process personal data in accordance with its own privacy policy. This Policy remains applicable to any instances where we provide personal data to third parties or engage third parties to process personal data on our behalf; we shall not be exempt from our statutory obligations regarding the protection of personal data merely by virtue of using third-party services. 1.3 This Policy applies to personal data processed by us that is capable of identifying you, either on its own or in combination with other information, including account details, subscription and transaction data, usage and security records, as well as personal data contained within user business data. We will not exclude data from the scope of personal data protection solely on the grounds that it has been submitted via an API, Skill, MCP or other service entry point. The specific rules governing the processing of user business data are set out in Article 3 of this Policy. ## II. HOW WE COLLECT AND USE YOUR PERSONAL DATA We process personal data only to the extent necessary to achieve the following purposes, in accordance with the principles of lawfulness, fairness, necessity and transparency. We will distinguish between processing that is necessary for the provision of services and processing that is optional; we will not make the acceptance of advertising tracking, marketing or other non-essential processing a condition for purchasing or using Pro services. For processing that relies on your consent, we will obtain such consent in accordance with the law and allow you to withdraw it; for activities that have other legal grounds for processing—such as the conclusion or performance of a contract to which you are a party, or the fulfilment of legal obligations—we will process personal data within the scope permitted by such grounds. The specific legal grounds for processing and applicable rights in different regions are set out in Section 7.10 of this Policy. ### 2.1 To Assist You in Registering and Managing Your Account When you register for an AnySearch account, we collect the following information: | Information Type | Specific Content | Collection Purpose | Necessary? | | ------------------- | -------------------------------------- | ----------------------------------------------------- | ---------- | | Account Information | Username, password (encrypted storage) | Create and verify account | Necessary | | Contact Information | Email address | Account security notifications, service notifications | Necessary | When you register and manage your account, we process your username, the irreversible hash of your password, and your email address for the purposes of creating your account, authentication, account recovery, and sending necessary security and service notifications. We do not store your login password in plain text. When you purchase Pro or another paid plan, we associate your account identifier with the plan name, subscription status, the start and end dates of your entitlements and necessary usage records in order to confirm the features, quota and service period available to you. This association does not include recording complete query content or complete search results in your account information. The applicable limitations are set out in Section 2.2 and Section 3. Failure to provide the information required to create and verify an account may result in you being unable to use services that require login; not purchasing Pro does not affect your use of the free services currently available, although such free services are subject to corresponding functional and usage restrictions. ### 2.2 Providing the Search API Service In order to carry out searches, route requests, aggregate results and perform content security checks, we process the queries you submit and the results returned in real time. The retention and deletion periods for queries, search results and temporary copies of content security checks shall be governed by Section 3.1. To verify free or paid entitlements, calculate remaining quotas, display usage and resolve billing disputes, we process the necessary metering information associated with your account or API Key, including the applicable subscription plan and billing cycle, the type of function called, usage time, number of calls, quota consumed, response status and billing results. This information does not include the full content of queries or complete search results. Service operation logs record only necessary technical fields, such as request time, response status, latency, number of results and random request identifiers. We do not use metering records, service logs or random request identifiers to establish or reconstruct any links between complete query content, complete search results and identifying information—such as accounts, API keys, email addresses, IP addresses or User-Agent strings—that could be retrieved or pieced together at a later date. ### 2.3 Providing Purchase, Subscription, Payment and Refund Services We process the following data based on the transactions you have actually carried out: (1) Order and subscription data: account identifier, order number, package purchased, subscription period, start and end dates of entitlements, amounts due and paid, currency, applicable taxes and charges, payment channel, transaction time and transaction status. This data is used to create orders, activate entitlements, reconcile accounts and provide access to billing information. (2) Renewal and subscription change details: When you opt for automatic renewal or change your subscription, we process information regarding whether renewal is enabled, the date of the next renewal, the date of authorisation or cancellation, change records, as well as the debit authorisation number or payment token returned by the payment platform (where provided by the payment method). This is used to execute the renewal, cancellation or subscription changes you have authorised. We do not regard your consent to this Privacy Policy as authorisation for automatic debits; automatic renewal must be confirmed separately in accordance with the procedures on the purchase page and via the payment platform. (3) Payment outcome data: Transaction numbers, payment account identifiers, payment success or failure statuses, and necessary error messages returned by the payment platform, used to verify receipt of funds, handle payment anomalies and prevent duplicate debits. The payment account identifier is not the same as a payment password or a full bank card number. (4) Refund and payment dispute data: Relevant orders, refund amounts, reasons for the request, processing status and any necessary supporting documents you submit, used to verify and process refunds, incorrect billing, unauthorised payments or payment disputes. (5) Invoicing data: If you request an invoice or other tax document, we will process the details you provide—such as the payee name, tax identification number, email address for receipt and billing information required by law—solely for the purpose of issuing and delivering the relevant documents and fulfilling our tax obligations. We do not directly collect or store full bank card numbers, card security codes or payment passwords. Such information is processed directly by the payment platform of your choice. We only process the information necessary to complete the relevant transaction; no data will be collected in relation to payment methods you have not used, auto-renewal services you have not activated or invoicing services you have not requested. The rules governing the provision and receipt of information in payment services are set out in Section 5.1.4. ### 2.4 Protecting Your Account, Subscription and Transaction Security We process login times, IP addresses and browser types (User-Agent) to identify abnormal logins, protect accounts and conduct security audits. In the event of subscription or payment anomalies, we will also verify, to the extent necessary, account status, transaction status, direct debit authorisation records and usage records to identify account impersonation, duplicate debits, unauthorised payments and abnormal usage behaviour. The processing described above is limited to what is necessary to ensure the security of our services and transactions; it is not used for advertising profiling, nor do we retain complete query content or search results on a long-term basis for this purpose. If security measures result in restrictions on your account or payment entitlements, you may request an explanation and a manual review via [support@anysearch.com](mailto:support@anysearch.com). ### 2.5 Enterprise Inquiries When you submit an enterprise inquiry form through the official website, we collect the following information: | Information Type | Specific Content | Collection Purpose | Necessary? | | ----------------------- | ----------------------------------------- | ---------------------------------------------- | ---------- | | Enterprise Information | Company name, contact name, email address | Business communication, solution customization | Necessary | | Requirement Information | Estimated monthly usage | Recommend suitable service plan | Necessary | | Source Information | Source IP, browser identifier | Prevent malicious submissions | Necessary | ### 2.6 Sensitive Personal Data and Non-Essential Data We do not make the provision of identity card or passport numbers, biometric information, precise geographical location, contact lists, text messages, call logs, or sensitive data such as religious beliefs, political views, sexual orientation or health status a general condition for purchasing or using AnySearch services. Where the law expressly requires the processing of such data and it is genuinely necessary to do so, we will explain in advance the purpose of the processing, its necessity and the impact on your rights and interests, and fulfil our corresponding obligations to provide notice and obtain consent in accordance with the law. Search queries and customer service input fields may contain sensitive data that you have voluntarily submitted. Please do not submit sensitive data unrelated to the service you are requesting, nor should you send full bank card numbers, bank card security codes, passwords or verification codes to customer service. We will not interpret your voluntary submission of such data as consent for us to use it for other purposes, and we will process and delete the relevant data in accordance with the timeframes set out in Article 3 or as necessary for the handling of customer service enquiries. ## 2.7 Explanation of Algorithms and Automated Decision-Making Our search results are processed and ranked based on the content of the query, keyword matches and relevance. We do not provide personalised recommendations based on account information, subscription transaction records or long-term search profiles. Differences in the features and usage allowances offered by different subscription plans are determined by the plan selected by the user and do not indicate that we apply unreasonable differential treatment to identical transaction conditions based on personal profiles. We use keyword rules and AI classification models to conduct content safety reviews of search results. This process is used to identify and filter out non-compliant content and is not used to create advertising profiles. If you have any objections regarding content filtering, account restrictions or actions relating to paid entitlements, you may request an explanation and a manual review via [support@anysearch.com](mailto:support@anysearch.com). For decisions made solely through automated decision-making that have a significant impact on an individual’s rights and interests, as stipulated by applicable law, we will provide the corresponding safeguards in accordance with the law. ### **2.8 Customer Support and Service Notifications** When you contact us regarding subscriptions, refunds, account or privacy issues, we process your contact email address, relevant account or order identifiers, a description of the issue, records of correspondence, and any evidence necessary to verify the issue, for the purposes of identity verification, issue resolution and dispute resolution. We only request information relevant to your enquiry and do not ask you to provide your account password, payment password or SMS verification code. We will use your email address or in-platform contact details to send notifications regarding activation, renewal reminders, payment results, failed payments, cancellation confirmations, refund results, and important security or service changes. Such notifications are sent to fulfil our service obligations or legal obligations. We do not regard the purchase of Pro as consent to receive marketing communications; marketing communications will comply with applicable consent and opt-out requirements. ## III. USER BUSINESS DATA **3.1 Processing of Query Content and Search Results** We process the query content you submit and the returned results in real time solely for the purposes of carrying out searches, routing requests, aggregating results, conducting necessary troubleshooting and performing content security reviews. The aforementioned content is stored in a separate, isolated temporary processing environment and is deleted once the relevant purposes have been fulfilled, no later than 24 hours after the corresponding service response has been completed. Temporary copies of content security reviews are deleted immediately upon completion of the review, no later than the aforementioned time limit. Purchasing Pro does not automatically enable long-term storage of search history or alter the retention periods stated above. We do not record complete query content or complete search results in account information, usage bills, user profiles, marketing systems or third-party analytics systems, nor do we retain any association between such content and user identity that could later be retrieved, combined or reconstructed. Where the law explicitly requires the retention of specific content, we shall only retain records necessary under the law, with restricted purposes, access rights and retention periods, and shall not use such records for marketing or other unrelated purposes. **3.2 Roles and Responsibilities in the Processing of Personal Data** With regard to activities such as account management, Pro benefits management, payment reconciliation, service security and customer support—where we determine the purposes and means of processing—we assume the corresponding responsibilities as a data user, personal data processor or data controller in accordance with the law. For personal data processing activities entrusted to us by corporate clients, where we act solely in accordance with their instructions, the roles and responsibilities of both parties shall be determined in accordance with the actual processing methods, applicable law and the relevant data processing agreement. Individual users shall not, by virtue of purchasing a Pro subscription or conducting personal searches, automatically become data controllers bearing responsibility for all processing activities on the platform. Where users decide to carry out further processing of search results on their own initiative, they must comply with applicable law; this responsibility does not exempt us from our obligations under the law regarding our own processing activities. 3.3 User business data may contain personal information, trade secrets or other information protected by law. Regardless of the service channel through which the data is submitted, we will assess the protection requirements based on the actual content and applicable laws, and will not lower our protection standards simply because the data is referred to as ‘business data’, ‘enquiry’ or ‘output’. Please submit only the information that is necessary to complete the relevant service and that you are authorised to submit. 3.4 **Model Training and Restrictions on Use** We do not use complete query content, complete search results or identifiable User Business Data to train or fine-tune models, or for targeted advertising or user profiling. Purchasing Pro, accepting this Policy or using the Service does not constitute authorisation for any of those purposes. Should we intend to carry out model improvement activities in the future that rely on users’ voluntary participation, we will clearly specify the scope of the data, the purpose of processing, the recipients and the retention period before commencing processing, and will obtain the necessary authorisation or consent in accordance with the law. Your refusal to participate will not affect your use of the purchased services unrelated to such processing. ## IV. HOW WE USE COOKIES AND SIMILAR TECHNOLOGIES ### 4.1 Use of Cookies When you visit our official website, the admin console, or the Pro purchase or subscription management pages, we use essential cookies or similar technologies to maintain your logged-in status, verify your session, ensure form security and complete the page operations you have requested. When you select a third-party payment method, that payment platform may use essential technologies within its payment process to ensure the security of payment sessions and transactions, as specified in its privacy policy and cookie notice. Technologies used to remember preferences such as language and theme, as well as those used for website analytics or advertising conversion, are described in the ‘Cookie Policy’ according to their actual purpose. Non-essential technologies may only be enabled after valid consent has been obtained as required by applicable law. We will not expand the scope of cookie collection or enable advertising tracking solely because you have purchased Pro. ### 4.2 Cookie Management 4.2.1 You may manage or delete cookies through your browser settings and manage your choices concerning non-essential technologies through the privacy settings we provide or by contacting [support@anysearch.com](mailto:support@anysearch.com). Disabling strictly necessary cookies may affect login, order confirmation or payment processes. Refusing non-essential analytics or advertising cookies will not affect your access to the core Pro services you have purchased. 4.2.2 Our API interfaces do not use cookies. API authentication is implemented through Bearer Token (API Key). 4.2.3 Logging out, clearing cookies or deleting browser data does not constitute cancellation of a subscription or revocation of authorisation for automatic direct debits via the payment platform. Subscription cancellations and the management of direct debit authorisations must be carried out through the relevant subscription or payment management procedures; rights relating to personal data may be exercised in accordance with Section 7 of this Policy. ### 4.3 Analytics, Advertising Tools and Usage Restrictions We do not use advertising tracking, cross-site behavioral analytics, or telemetry in the AnySearch Skill or MCP services. On the public website, marketing pages, management console, and payment pages, we may use the following tools only after obtaining consent where required by applicable law: | Tool | Provider | Purpose | | ------------------------------ | -------- | ------------------------------------------------------------ | | Google Analytics | Google | Website traffic and feature-usage statistics | | Google Ads conversion tracking | Google | Measuring advertising conversions | | Meta/Facebook Pixel | Meta | Measuring advertising conversions and campaign effectiveness | | Twitter/X Ads tag | X Corp. | Measuring advertising conversions and campaign effectiveness | We do not load or invoke the aforementioned non-essential tools without valid consent, where you have refused or withdrawn your consent, or where a GPC signal requires the cessation of the relevant processing. We do not send internal user IDs, email addresses, API keys, full query content, full search results, payment account identifiers, payment tokens, debit authorisation numbers or order numbers that can be linked to an individual to analytics or advertising platforms, nor do we enable functions that match identities using these identifiers. Statistics on purchase conversions are also subject to the above restrictions. Any permitted analytics or conversion statistics must still comply with applicable notification, consent and opt-out requirements. --- ## V. HOW WE SHARE, ENGAGE PROCESSORS FOR, TRANSFER, AND PUBLICLY DISCLOSE YOUR PERSONAL DATA ### 5.1 Sharing We provide personal data to the third-party recipients or service providers listed in this policy—including payment services, cloud infrastructure, email, content security and third-party AI model providers—only to the extent necessary for the provision of services, the performance of contracts, compliance with the law or the obtaining of consent as required by applicable law. The specific categories of data, purposes of processing, roles of recipients and cross-border arrangements are set out below. 5.1.1 **Sharing with your explicit consent:** After obtaining your separate consent through pop-ups or checkboxes, we may share your personal data with third parties designated by you. 5.1.2 **Sharing with affiliated companies:** To facilitate the provision of unified account services and security protection, your personal data may be shared among our affiliated companies. We will only share necessary personal data, and such sharing is subject to this Policy. 5.1.3 **Legal requirements:** As required by laws and regulations, litigation dispute resolution needs, or lawful requests from administrative or judicial authorities. 5.1.4 **Third-Party Payments and Subscription Settlement** When you choose a third-party payment method to purchase or renew a Pro subscription, we exchange the order and transaction details necessary for completing payments, automatic renewals, reconciliation, refunds and the resolution of payment disputes with your chosen payment service provider. Full bank card numbers, security codes and payment passwords are processed directly by the payment service provider; we do not receive or store them. Automatic renewal requires separate, explicit authorisation; acceptance of this Privacy Policy does not constitute authorisation for automatic debits. **5.1.5 Search and Related Technical Service Providers** In order to carry out the search, aggregate results or perform AI processing you have requested, we may send the query content or result snippets necessary to fulfil that request to service providers offering cloud infrastructure or third-party AI model capabilities, without attaching any account details, payment details or subscription transaction records unrelated to that request. As the query content itself may contain personal data, such transmission may still constitute the processing of personal data even if no account identifiers are attached. Section 5.2 applies to processors acting on our behalf; for service providers acting as independent recipients, we fulfil the corresponding notification and equivalent obligations in accordance with the law. Where cross-border transfers are involved,Section 6.1 also applies. We will disclose the actual recipients, the purposes of processing, the categories of data and other necessary information in accordance with the law prior to the commencement of the relevant processing. ### 5.2 Entrusted Processing We provide service providers acting on our behalf only with the personal data necessary to perform their assigned tasks. Our agreements with them specify the purposes, duration and methods of processing, the categories of data, required security measures and the responsibilities of both parties. We monitor their processing to ensure compliance with our instructions and applicable law. They must not change the purposes of processing without authorisation or use the data for their own marketing, user profiling or model training. **Cloud infrastructure providers:** To the extent necessary for the provision of storage, computing, backup and service operation support, they process account, subscription, transaction, usage, security and temporary query data within the relevant systems, whilst complying with the access and deletion requirements set out in this Policy. **Email Service Provider:** Processes the recipient’s email address, as well as the minimum information required to send verification codes, security notifications, subscription notifications and transaction notifications, such as the type of notification, relevant package, amount, status or date; full search queries, full search results, payment passwords or full bank card numbers shall not be provided to them. Where new data processors are appointed or the scope of processing by data processors is altered, we shall update the disclosure in accordance with the law prior to the commencement of the relevant processing, and fulfil the required notification or equivalent obligations. We will set out the names of the actual service providers, their processing roles, the purposes of processing, the categories of data, the countries or regions where processing takes place, the retention periods and the applicable cross-border data transfer mechanisms in the publicly available ‘List of Service Providers and Cross-Border Data Transfers’. Where new key service providers are added that will receive enquiry content, payment details or account identifiers, or where there is a substantial change to their processing purposes, we will update the list in accordance with the law prior to the commencement of the relevant processing, and comply with the applicable notification, consent or other procedures. ### 5.3 Transfer We do not transfer your personal data to any third party, except in the following circumstances: 5.3.1 With your explicit consent; 5.3.2 In the event of a merger, acquisition, asset transfer, or similar transaction involving the transfer of personal data, we will require the new holder to continue to be bound by this Policy; otherwise, we will require them to obtain your renewed authorization and consent. ### 5.4 Public Disclosure We do not publicly disclose your personal data, except in the following circumstances: 5.4.1 With your explicit consent; 5.4.2 As required by laws and regulations, litigation dispute resolution needs, or lawful requests from administrative or judicial authorities. --- ## VI. HOW WE STORE AND PROTECT YOUR PERSONAL DATA ### 6.1 Storage Locations We maintain servers around the world, and therefore the servers used to process your information may not be located in your country/region. We may process and store your personal data on servers in multiple jurisdictions for the purposes described in this Policy, or in facilities and servers located in countries/regions where our affiliates, partners, suppliers, and service providers are located. Notwithstanding differences in data protection laws across countries, wherever your personal data is processed, we will protect it in accordance with the safeguards described in this Policy and will only transfer data pursuant to lawful and valid data transfer mechanisms. Data protection laws vary by country/region, and the level of data protection may differ. Regardless of where we process your information, we will uniformly apply the protective measures described in this Privacy Policy. We will disclose the categories of processors, processing purposes, data categories, recipient countries or regions, and retention periods actually involved in the Privacy Policy, Cookie Policy, or relevant service page. For users in mainland China, where the provision of personal data to overseas recipients is involved, we will, prior to such provision and in accordance with the law, inform you of the name or full name of the overseas recipient, their contact details, the purpose and method of processing, the categories of personal data concerned, and the means and procedures for you to exercise your rights vis-à-vis the overseas recipient; we will also obtain separate consent where required by law. We will carry out personal data protection impact assessments in accordance with the law and, subject to applicable conditions, fulfil security assessments, enter into standard contractual sections, obtain certification or meet other statutory requirements; where exemptions apply under the law, we will still fulfil any protection obligations not covered by such exemptions. Cross-border activities that must be completed following relevant statutory procedures shall not be carried out until such procedures have been finalised. The same cross-border safeguards apply to Pro account, subscription, order, payment and customer-support data. Purchasing Pro does not constitute general authorisation to provide personal data to any overseas entity. On the relevant service or notice page, we will specifically disclose the actual recipients, recipient countries or regions, scope of data, purposes and retention period, or the criteria used to determine that period. ### **6.2 Retention Periods** We determine the necessary minimum retention periods based on the category of data and the purpose of processing; we do not retain data indefinitely simply because a user has purchased the Pro service: **(1) Query content, search results and temporary copies of content for security purposes:** In accordance with Section 3.1, these are deleted once the relevant purpose has been fulfilled, and no later than 24 hours after the corresponding service response has been completed; except for specific records that are explicitly required to be retained by law. **(2) Account information:** Retained for the period necessary to provide account services. Upon account closure, except for data required to be retained by law, such data shall be deleted or anonymised within 30 days in accordance with Section 7.5.3. **(3) Subscription and entitlement information:** Retained for the period necessary to confirm and provide the purchased entitlements, execute authorised renewals, process cancellations and carry out necessary settlements. Upon termination of the subscription, such data shall no longer be used for subsequent automatic debits; any portions required to be retained as transaction evidence in accordance with the law shall be handled in accordance with the following section. **(4) Order, payment, debit authorisation, cancellation, refund and invoicing records:** Retained for the period required by applicable tax, accounting and payment regulations, as well as for the resolution of specific transaction disputes. Records of revoked authorisations shall be retained only to the extent necessary to prove the authorisation, revocation and resolution of disputes, and shall not be used to initiate further debits. **(5) Usage, security and service operation records:** Retained only for the period necessary for metering, reconciliation, security assurance, the resolution of specific disputes or the fulfilment of statutory obligations; these do not include the full content of enquiries or complete search results. **(6) Customer service records and supporting documents:** Retained until the relevant issue has been resolved and the necessary dispute resolution period has expired. Information unrelated to the request is not retained on an ongoing basis. **(7) Privacy choices and consent records:** Retained only for the period necessary to demonstrate consent, withdrawal of consent, and to fulfil necessary compliance audit obligations. Upon expiry of the relevant retention periods, we shall delete or anonymise the relevant data. For data that must be retained in accordance with the law or that cannot be immediately deleted from backups for technical reasons, we shall restrict its processing, using it solely for necessary storage and security protection, or for specific retention purposes permitted by law; upon restoration from backups, any deletion requests that have taken effect shall be executed once again. De-identification is not equivalent to anonymisation; data that remains capable of identifying individuals shall continue to be subject to this Policy. ### 6.3 Security Measures We implement the following technical and administrative measures to protect the security of your personal data: **Technical Measures:** - Passwords encrypted using bcrypt algorithm, stored in an irreversible (hashed) format; - Data transmission encrypted using HTTPS/TLS; - Email addresses and other sensitive information stored in masked form; - Database access permissions strictly controlled following the principle of least privilege. **Administrative Measures:** - Establishment of data security management systems and operational procedures; - Security training for employees who may have access to personal data; - Access permissions management and auditing for personal data access; - Development of personal data security incident response plans. We restrict access to subscription, transaction and direct debit authorisation data in accordance with roles and processing purposes, and audit any necessary access. Payment tokens or direct debit agreement identifiers are used solely for the processing of transactions authorised by the user and are not disclosed on standard web pages, in non-essential logs or in customer service replies. Our customer service team will never ask you to provide your login password, payment password, bank card security code or SMS verification code. We will not lower the existing security standards for free users’ personal data simply because you have purchased a Pro subscription. ### 6.4 Security Incident Handling 6.4.1 In the event of a personal data security incident, we will, in accordance with applicable laws and regulations, promptly inform you of the nature and scope and potential impact of the incident, the measures we have taken or will take, recommendations for you to independently prevent and reduce risks, and remedies available to you. 6.4.2 We will notify you individually through email, on-site notifications, or other means. Where individual notification is impractical, we will publish a public announcement in a reasonable and effective manner. 6.4.3 We will also proactively report the handling of personal data security incidents to regulatory authorities as required. ## VII. HOW YOU MANAGE YOUR PERSONAL DATA You have the following rights regarding the personal data we process: ### 7.1 Access and Copy You may view the account details, usage statistics and API key information provided via the Management Console. Alternatively, you may submit a request via support@anysearch.com to view or obtain copies of the account details we hold relating to you, including your Pro plan and its validity period, subscription status, usage records, order and payment records, renewal authorisations and cancellation records, refund records and customer service correspondence. Following verification of your identity, we will provide the relevant information in accordance with applicable law, whilst protecting any personal data relating to third parties or information protected by law. We will not regenerate query content or search results that have been deleted in accordance with this policy in response to requests for access or copies. ### 7.2 Correction and Supplementation If your account details, contact details, billing information or other personal data are inaccurate or incomplete, you may correct them using the functions provided in the Management Console, or submit a request by contacting support@anysearch.com. For transactions or accounting records that cannot be directly amended in accordance with the law, we will handle them by means of correction, supplementation or annotation in accordance with the law. For data held independently by the payment platform, you may exercise your relevant rights with that platform; we will provide the necessary assistance within the scope of our responsibilities. ### 7.3 Deletion You may request deletion of your personal data under the following circumstances: - The processing purpose has been achieved, cannot be achieved, or is no longer necessary for achieving the processing purpose; - We cease providing services, or the retention period has expired; - You withdraw your consent; - We process personal data in violation of applicable laws, regulations, or agreements; - Other circumstances provided by applicable laws and regulations. **Please note:** Cancelling a Pro subscription, deleting your account and requesting the deletion of personal data are distinct actions. You may request the deletion of personal data that no longer needs to be processed whilst retaining your account. In the case of transaction, tax, payment or security records that must be retained by law, we will continue to store them to the extent necessary, restrict their use and access, and delete or anonymise them once the relevant retention period has expired. We will not automatically extend the retention period for all data simply because you have exercised your right to erasure. Where a request for erasure concerns data necessary for the continued provision of a specific service, we will specify the particular service affected and will not restrict functions unrelated to that processing. ### 7.4 Withdrawal of Consent and Management of Privacy Preferences 7.4.1 For the processing of personal data carried out on the basis of your consent, you may withdraw your consent via the privacy settings provided, the relevant opt-out methods, or by contacting support@anysearch.com. Upon withdrawal of consent, we shall cease the relevant processing, unless continued processing is permitted or required by law. 7.4.2 The withdrawal of consent does not affect the lawfulness of processing activities carried out on the basis of valid consent prior to such withdrawal. 7.4.3 Refusing or withdrawing consent for non-essential analytics, advertising or marketing will not affect your use of the core Pro features unrelated to such processing. Processing that is necessary for the performance of a contract or to comply with a legal obligation, and which has an independent legal basis, will not automatically cease as a result of the withdrawal of other consents; we will explain the relevant legal basis and scope in accordance with the law. 7.4.4 Withdrawing privacy-related consent does not constitute cancellation of a subscription or revocation of an automatic-debit authorisation. You may cancel the subscription or revoke the authorisation through the applicable subscription or payment management process and may contact us for assistance. ### 7.5 Account Closure 7.5.1 You may request to close your account via [support@anysearch.com](mailto:support@anysearch.com). We will only verify the identity details necessary to process this request. 7.5.2 Prior to completing the account closure, we will explain the impact of closure on active subscriptions, remaining entitlements, access to data and data deletion, and assist you in cancelling relevant subscriptions and revoking direct debit authorisations. For automatic renewals managed by us, subsequent renewal payments will cease upon completion of the account closure. For authorisations that you need to manage via third-party payment platforms or sales channels, we will clearly explain the procedure. With regard to outstanding refunds, settlements or disputes, we will retain relevant data only to the extent necessary to process these matters and will not continue any unrelated data processing on this basis. The processing of refunds and remaining entitlements is subject to the Terms of Service and applicable law. 7.5.3 Following account closure, we will delete or anonymise your personal data within 30 days, except for data that must be retained in accordance with the law. The categories, purposes and retention periods for retained data shall be in accordance with Section 6.2. Anonymisation shall be carried out to such an extent that the data is no longer personally identifiable and cannot be reversed. 7.5.4 Cancelling a Pro subscription alone does not typically result in account closure. Whilst the account remains active, we will continue to process the data necessary to provide the account and the services available at that time in accordance with this Policy. ### 7.6 Portability You have the right to request that we transfer your personal data to another personal data processor designated by you. Where legally permissible, we will provide the means for such transfer. ### 7.7 How to exercise your rights 7.7.1 You may submit requests to access, copy, rectify, erase or exercise other rights relating to your account, subscription, transactions, usage or other personal data via support@anysearch.com. We will only carry out identity verification commensurate with the risk associated with the request and will not ask you to provide your password or verification code. 7.7.2 We shall verify your identity and respond within the timeframe required by applicable law; where the law does not specify otherwise, we shall respond within 15 working days. Where an extension is required by law, we shall explain the reasons and the expected completion date. Where we are unable to fulfil all or part of a request, we shall explain the reasons and the available avenues for appeal. 7.7.3 Reasonable requests shall, in principle, be processed free of charge. We shall only take corresponding measures where applicable law permits the charging of a fee or the refusal to process the request, and shall explain the basis for doing so; we shall not automatically charge a fee merely because a user has submitted a repeat request. The exercise of your rights in relation to personal data shall not affect your statutory rights to a refund or other consumer rights. ### 7.8 Right to Complain If you believe that our personal data processing activities have infringed upon your lawful rights and interests, you have the right to lodge a complaint with competent regulatory authorities (including but not limited to the Office of the Privacy Commissioner for Personal Data, Hong Kong) in accordance with applicable laws and regulations. ### 7.9 Protection of Deceased Persons' Personal Data In the event of the death of an AnySearch user, the processing of their personal data will be carried out in accordance with the Personal Data (Privacy) Ordinance (PDPO) of Hong Kong and relevant legal provisions. Generally, personal data of deceased persons is no longer protected under the PDPO, but close relatives may access relevant information based on other legal rights (such as estate administration). ### 7.10 Additional Information for Users in Specific Regions **Users in the EU and the UK:** Within the scope of applicable data protection legislation, we process data necessary for account activation, the provision of Pro benefits, metering and billing on the basis of the performance of a contract; we process statutory transaction and tax records on the basis of compliance with legal obligations; and when carrying out necessary account security and anti-fraud processing, we do so on the basis of legitimate interests, provided that the conditions are met and your rights are not overridden; non-essential tracking or marketing processing for which consent is required by law is based on your consent. You have the legal rights to access, rectify, erase, restrict processing, data portability and object to processing, and you may withdraw your consent or lodge a complaint with a supervisory authority. For decisions made solely on the basis of automated processing that produce legal effects or similarly significant effects, you are entitled to the safeguards provided for under applicable law. **Users in California:** To the extent permitted by applicable law, you may request to be informed of, access, rectify or erase your personal data, and may opt out, in accordance with the law, of the sale of personal data or its sharing for cross-context behavioural advertising, as well as restrict the use of sensitive personal data beyond the permitted purposes. The disclosure of data to third parties via advertising or analytics technologies may constitute a ‘sale’ or ‘sharing’ as defined by law, even if no monetary consideration is received; we will disclose such processing in accordance with the actual circumstances and provide applicable opt-out mechanisms and process GPC signals. We will not discriminate against you, as prohibited by law, for exercising your statutory privacy rights. **Users in Mainland China:** We safeguard your rights to be informed, to make decisions, to restrict or object to processing, to access, copy, rectify, supplement and delete your personal data in accordance with the law, and provide means of data portability where applicable. Where sensitive personal information is involved, or where personal information is provided to other personal information processors or transferred overseas, we shall fulfil the corresponding obligations regarding notification, separate consent and other protective measures in accordance with the law. --- ## VIII. Protection of Minors’ Personal Data This Service is not intended for persons under the age of 18 or persons who have not reached the legal age of majority in their jurisdiction, and we do not knowingly collect their personal data. If a guardian believes that a minor has provided us with personal data, the guardian may contact [support@anysearch.com](mailto:support@anysearch.com). Following reasonable verification, we will delete the relevant data or restrict its processing in accordance with applicable law, while retaining only the minimum records necessary to comply with legal obligations, address security incidents or process refunds. ## IX. Updates to this Policy 9.1 We may update this Policy in response to changes in laws and regulations, adjustments to our services, or changes to our personal data processing activities, and will indicate the latest version, publication date and effective date. 9.2 We will notify you of any updated Policy at least seven days prior to its coming into effect via an announcement on our official website, an in-app notification or by email; where applicable law requires a longer notice period or other means of notification, such provisions shall prevail. In the event of significant changes, we will provide a prominent notice detailing the affected sections and the main changes. 9.3 Where changes to the purposes, methods, categories of data, recipients, cross-border arrangements or retention periods require us to obtain renewed consent, separate consent or fulfil other procedures in accordance with the law, we will complete these steps before commencing the relevant processing. Continued use of the services, purchase of Pro, or failure to respond shall not be deemed to constitute the explicit consent required by law. 9.4 Your refusal to consent to new, non-essential processing shall not affect your use of purchased services unrelated to such processing. Should the changes genuinely affect the continued provision of a particular service, we shall explain the specific reasons, the scope of the impact and the available options, and shall handle cancellations, remaining entitlements or refunds in accordance with the Terms of Service and applicable law. ## X. How to Contact Us If you have any queries regarding this Policy, or wish to exercise your rights in relation to your account, Pro subscription, orders, payments, usage or other personal data, please contact Any Limited at: support@anysearch.com. Please specify the nature of your request and provide the necessary account or order identification details; do not send login passwords, payment passwords, bank card security codes or SMS verification codes. We will verify your request and respond within the timeframe specified in Section 7.7. If you are dissatisfied with the outcome, you may request further clarification or lodge a complaint with the competent data protection, cyberspace administration or other regulatory authorities in accordance with the law, including the Office of the Privacy Commissioner for Personal Data in Hong Kong; you may also seek redress from the competent courts in accordance with the law. ## APPENDIX: DEFINITIONS | Term | Definition | | ---------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Personal Data** | Any data relating directly or indirectly to a living individual from which it is practicable for the identity of the individual to be ascertained, and which is in a form in which access to or processing of the data is practicable. | | **Sensitive Personal Data** | The Personal Data (Privacy) Ordinance of Hong Kong does not explicitly define "sensitive personal data," but it generally refers to personal data that may pose greater risks to individuals, such as race, ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, health data, sex life or sexual orientation data. We adopt stricter safeguards when processing such data. | | **Data User** | A person who, alone or jointly with others, controls the collection, holding, processing, or use of personal data. | | **Data Processor** | A person who processes personal data on behalf of a data user and does not process personal data for their own purposes. | | **User Business Data** | Queries submitted by users via AnySearch’s API, Skill, MCP or other search service entry points, and the corresponding results returned. Where such content includes personal data, it is protected by this Policy and relevant legislation. | | **Anonymization** | A process by which personal data is processed such that it can no longer be used to identify a specific natural person and cannot be reversed. | | **De-identification** | A process by which personal data is processed such that it cannot be attributed to a specific natural person without the use of additional information. | | **Subscription Data** | Information used to identify and manage paid entitlements, including the selected plan, subscription period, start and end dates of entitlements, renewal status, authorisation, changes and cancellation records. | | **Metering data** | Information such as function type, usage time, frequency, quota and processing status, used to verify usage quotas, calculate charges and resolve billing disputes; this does not include the full content of queries or complete search results. | | **Payment token or direct debit authorisation identifier** | A technical identifier used by payment platforms to identify a specific payment method or direct debit authorisation; this is not the same as a full bank card number or payment password, and its use is restricted to the scope of the relevant authorisation. | ---