Privacy Policy

1. Who handles your information

CoreCharge Cloud (Shenzhen) AI Technology Co., Ltd. operates this website and merchant platform. For our own business inquiries, account administration, billing and security purposes, we determine how necessary personal information is used. The controller identity and contact details appear at the end of this notice.

When a rental operator determines how its customer data is used and instructs us to host or process it for the service, the operator is the controller and CoreCharge acts as its processor for that activity under the DPA. The actual role depends on the processing, not merely the service name. A rental customer should contact the operator shown on the rental page first; we assist with requests concerning data we process on its instructions.

2. Information and its purposes

The information below reflects the standard service and depends on the merchant’s enabled modules. An order and processing schedule record additional project-specific fields. Do not put passwords, full card numbers, identification documents or sensitive personal information in the website inquiry form. Payment providers handle their own processing under the relevant notice.

3. Why processing is permitted

Where the applicable law requires a legal basis, it is assessed for each purpose: contract performance or requested pre-contract steps when the individual is a party; legitimate interests, where available and balanced, for business contact, service security and ordinary support; legal obligations for mandatory records; and consent for uses that require it, such as relevant optional marketing or tracking.

A company’s service contract does not automatically make contract performance the basis for all of its employees’ personal information. We do not use an inquiry submission or acceptance of SaaS terms as blanket marketing consent. Consent can be withdrawn without affecting prior lawful processing.

Purpose-by-purpose: responding to an individual’s requested quotation uses pre-contract steps where applicable; business-representative inquiries, account support and service security rely on legitimate interests where available and balanced; billing and statutory evidence rely on the contract with an individual party or legal duties; optional advertising measurement requires the visitor’s choice; operator-controlled rentals follow the operator’s lawful documented instructions.

4. Recipients and providers

Access is limited to people with relevant duties and providers engaged for the actual service. Tenant data is available only to roles authorized by the merchant. Necessary disclosure may occur for a legal obligation or a genuine legal claim. The standard provider register is below; project-specific integrations are recorded in the service order.

We do not sell instructed rental customer data as a dataset or use it for unrelated CoreCharge advertising. Optional Google advertising measurement may constitute legally defined sharing or targeted advertising where relevant. You can refuse it using Cookie settings; Global Privacy Control is treated as a refusal. Payment and communications providers may act independently under their own contracts.

5. International processing

The standard production servers, databases and observed server-side backup copies are in Singapore. CoreCharge staff in China may access necessary information for authorized administration and support. Provider-controlled email delivery, optional Google measurement, WhatsApp and payment services can involve other countries as listed above. We do not promise EU-only or country-local storage worldwide.

For a legally restricted transfer, the relevant parties must put in place the applicable lawful mechanism, recipient terms, assessment and any necessary supplementary measures before that processing. Contact us for the arrangements applicable to your project. This notice and the published DPA do not themselves constitute executed EU SCCs, a UK transfer instrument or ANPD standard clauses; a required mechanism is completed separately and processing must be limited until then.

6. Retention and deletion

We retain personal information only for the purpose, documented merchant instructions and applicable legal duties. The schedule below and the Merchant SaaS Terms govern our standard retention and exit process. Technical staff perform scoped reviews, export and deletion; the platform does not offer a complete one-click tenant erasure function.

A necessary legal hold is limited to specified records, access and purpose and reviewed periodically. We record the reason and applicable legal period for accounting, tax, payment or dispute evidence rather than applying an invented worldwide period. Deleted data in backups is restricted from ordinary use and removed or retired within the stated backup cycle; erasure instructions are reapplied if a backup is restored.

7. Requests and choices

Depending on the law that applies, you may request access, correction, deletion, restriction or portability, object to certain processing, withdraw consent, and complain to the relevant supervisory authority. Rights have legal conditions and exceptions. We verify identity proportionately, assess the request and respond within the applicable legal period; we do not require unnecessary documents.

Send requests to manghe@corechargecloud.com with the relevant account, operator and request details. Do not send passwords or full payment credentials. For operator-controlled rental records, we route the request to the operator or assist it as permitted. Cookie and advertising preferences are distinct from a request to delete an account.

Technical staff handle verified export or deletion through a secure process and provide the outcome, including any justified remaining records. We aim to acknowledge requests within 10 business days and apply the shorter mandatory deadline where required. For EEA/UK requests, the usual response period is one month, with lawful extensions explained; where California law applies, qualifying access/correction/deletion requests are normally answered within 45 calendar days, with any lawful extension notified.

8. Regional information

EEA and UK: when the GDPR or UK GDPR applies, you may use the rights above and complain to your competent supervisory authority, including in your habitual residence, place of work or alleged infringement. We assess representative or officer requirements for the actual service; we do not claim an appointment or certification that has not been made. Required merchant processing and transfer documents are completed for the applicable project.

United States: rights depend on the relevant state law and its applicability. Where applicable, you may request access, correction, deletion or portability, opt out of sale/sharing or targeted advertising, and use an authorized agent subject to verification. We do not discriminate for exercising rights. Cookie settings provide an advertising opt-out; a valid Global Privacy Control signal overrides advertising permission. Contact us for an appeal where your state law provides one.

Brazil: where LGPD applies, you may request confirmation, access, correction, anonymization/blocking/deletion of unnecessary or unlawfully processed data, portability as regulated, information about sharing and consent, and consent withdrawal, subject to legal conditions. Contact our privacy channel below or ANPD. A Portuguese summary explains Singapore hosting and support access from China. Other Latin American markets are assessed under their own laws; Brazil is not a substitute for them.

9. Security, age and policy changes

Our public website and dashboard use HTTPS; the platform has authenticated access and configured role permissions, and technical administration is limited to authorized personnel. Server backups are access-restricted. Security and privacy incidents are escalated through the contact channel and investigated by technical staff. Project safeguards and any additional requirements are recorded in the DPA and service order; no absolute security, ISO certification, universal MFA or database-at-rest encryption is promised here.

The merchant dashboard is intended for authorized business users, not children. Local operators set lawful consumer rental age conditions. If a child’s information has been submitted improperly, contact us so we can investigate with the relevant operator.

This policy is effective from 11 October 2026. We publish the date of updates and communicate material service changes appropriately. Contract changes follow the written service agreement; privacy consent is obtained separately where required.

Related documents

• Merchant SaaS Terms
• Data Processing Agreement
• Cookie and Advertising Technology Policy
• Website Terms of Use