Privacy Policy.

A.0 Header block

A.0.1 Document title

This document is titled Privacy Policy.

A.0.2 Effective date and last update

Effective 09 October 2026. Last updated 09 October 2026. We will revise this notice when our practices change and post the updated version at the same URL.

A.0.3 Data controller entity

The data controller is PHARMINCEPT INDUSTRIAL CO., LIMITED (verbatim SEPC L4).

A.0.4 Office address

Our registered office is Room 2, LG1, Mirror Tower, 61 Mody Road, Tsim Sha Tsui, Hong Kong (verbatim SEPC L2).

A.0.5 Contacts

• General / privacy inquiries support@famingsai.com (SEPC L16).
• Key accounts / commercial zengzhiyong@famingsai.com (SEPC L23).

A.0.6 Website

https://famingsai.com (SEPC L8).

A.0.7 Scope

This policy covers: (a) the corporate website at famingsai.com; (b) our mobile management applications distributed via the Apple App Store and Google Play; and (c) the third-party services integrated into those products, including the nineteen advertising SDKs described in §A.7. It does not cover third-party websites that we link to from our content.

A.1 Information we collect

A.1.1 Data supplied by the user

When you create an account, contact our sales desk, sign up for our newsletter, or send us a sourcing brief, you may provide identifiers such as your full name, business email, company name, country, phone number, and message contents. Where you use a courier or freight-forwarding service, you may provide a delivery address.

A.1.2 Data collected automatically

When you visit our website or use our apps we automatically log the IP address, approximate geolocation derived from the IP, device type, operating system and version, app version, locale, language, screen size, referrer, and timestamps. We use this data to operate, secure, and improve the service.

A.1.3 Data collected via cookies and similar technologies

We use HTTP cookies, localStorage, and IndexedDB to remember your preferences, keep you signed in, and measure aggregate traffic. See §A.11 for the categories we use.

A.1.4 Data collected via in-app advertising SDKs

The mobile applications we distribute via Apple App Store and Google Play integrate the nineteen advertising SDKs listed in §A.7. Each SDK processes identifiers such as the Google Advertising ID (GAID), Apple's Identifier for Advertisers (IDFA), IP address, device info, coarse location, and event interactions, all subject to the partner's privacy policy.

A.1.5 Data collected via analytics and crash-reporting SDKs

We use anonymised analytics to understand feature usage and crash reports to diagnose stability issues. Analytics events are aggregated; crash reports are limited to device, OS, and stack-trace data needed to fix the bug.

A.1.6 Sensitive categories we do NOT collect

We do not knowingly collect government identifiers (passport, national ID, social security number), payment card data, biometric data, health data, or precise location data. We do not collect special-category data defined under GDPR Article 9.

A.2 How we use information (purposes and lawful basis)

A.2.1 Service delivery (contractual necessity)

We process your data to provide the products and services you request, accept orders, dispatch shipments, and provide customer support. The lawful basis under GDPR Article 6(1)(b) is performance of a contract.

A.2.2 Customer support (legitimate interest)

We use contact data to respond to your inquiries, troubleshoot issues, and improve the service. The lawful basis is our legitimate interest under GDPR Article 6(1)(f).

A.2.3 Marketing communications opt-in basis (consent)

We send newsletters and marketing emails only when you have opted in. You can unsubscribe at any time using the link in every email or by contacting support@famingsai.com. The lawful basis is consent under GDPR Article 6(1)(a).

A.2.4 Personalised advertising in our apps

For users in the EU, UK, and Brazil, personalised advertising requires your consent (GDPR Article 6(1)(a); LGPD Art. 7º). For California users, you may opt out of the "sale or sharing" of personal information (CCPA/CPRA). We display an in-app consent prompt that records your choice.

A.2.5 Security, fraud prevention, legal compliance

We process data to detect and prevent fraud, secure our infrastructure, and comply with our legal obligations. The lawful bases are legal obligation (Article 6(1)(c)) and legitimate interest (Article 6(1)(f)).

A.2.6 Aggregated analytics (legitimate interest)

We derive aggregate statistics from usage data to improve the service. Where possible we anonymise or aggregate the data so it cannot identify you.

A.3 How we share information

A.3.1 Service providers

We share data with vendors that help us run our business: cloud hosting providers, transactional email providers, customer support tooling, and analytics vendors. Vendors are bound by written data-processing agreements.

A.3.2 Ad-tech partners

The nineteen advertising SDKs in §A.7 receive data directly from your device when the apps are in use. Each partner operates under its own privacy policy and consent framework.

A.3.3 Legal disclosure

We may disclose personal data in response to a subpoena, court order, regulator request, or other valid legal process. Where lawful and feasible, we will notify you before disclosing.

A.3.4 Business transfers

If we undergo a merger, acquisition, or sale of assets, personal data may be transferred subject to confidentiality and security commitments at least as protective as this policy.

A.3.5 No sale of personal data

We do not sell your personal data for money. Where advertising partners receive device identifiers for personalised ads, this may be considered a "sale" or "share" under CCPA/CPRA; you can opt out see §A.9.3.

A.4 International data transfers

A.4.1 Hong Kong base + global ad-tech destinations

Our primary base is in Hong Kong. Personal data may be transferred to and processed in the European Economic Area, the United Kingdom, Switzerland, the United States, Brazil, Singapore, Japan, Australia, and other jurisdictions where our vendors and ad partners operate.

A.4.2 Transfer mechanisms

For transfers from the EU/EEA we rely on the European Commission Standard Contractual Clauses (SCCs). For transfers from the UK we use the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs. For Switzerland we follow the FDPIC's recognised mechanisms. For transfers out of mainland China we may use the CAC Standard Contract where applicable.

A.4.3 Government-access risk disclosure

Where personal data is routed through the United States, it may be subject to US laws such as the CLOUD Act and FISA Section 702 that permit government access in defined circumstances. We apply encryption in transit and at rest, vendor-side access controls, and contractual safeguards to mitigate these risks.

A.5 Data retention

A.5.1 Account data

We retain account data while your account is active and for up to 24 months after account closure to honour legal obligations (tax, anti-fraud), unless a longer period is required by law.

A.5.2 Server logs

Server logs (access, error, security) are retained for 12 months unless needed for an ongoing investigation.

A.5.3 Ad SDK identifiers

Advertising identifiers are retained per each partner's window in §A.7. Many partners reset or anonymise identifiers within 13 8 months.

A.5.4 Backups

Encrypted backups are retained on a 90-day rolling window. Backups are deleted automatically at the end of the window.

A.6 Your rights and choices

A.6.1 Access, correction, deletion (GDPR Art. 15 7)

You have the right to request access to your personal data, correction of inaccurate data, and deletion of data we are not required to retain.

A.6.2 Data portability (GDPR Art. 20)

Where processing is based on consent or contract and carried out by automated means, you can request a portable copy of your data in a structured, commonly used format.

A.6.3 Restriction and objection (GDPR Art. 18, 21)

You may ask us to restrict processing in defined circumstances and object to processing based on legitimate interest, including direct marketing.

A.6.4 Withdraw consent at any time

Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.

A.6.5 California rights (CCPA/CPRA)

Californians can exercise the right to know, delete, correct, and opt out of sale or sharing, and the right to limit use of sensitive personal information. See §A.9.3.

A.6.6 Brazil rights (LGPD)

Brazilian users have the rights enumerated in LGPD Article 18, including confirmation of processing, access, correction, anonymisation, portability, deletion, and information about sharing. See §A.9.5.

A.6.7 China rights (PIPL)

Users in mainland China and Hong Kong PIPL-extraterritorial scenarios have rights of access, correction, deletion, and portability, plus separate-consent rights for sensitive personal information, cross-border transfers, and automated decision-making. See §A.9.4.

A.6.8 How to exercise

Email support@famingsai.com. We respond within statutory windows (typically 30 days under EU/UK, 45 days under CCPA). We may need to verify your identity to protect against fraudulent requests.

A.7 Third-party advertising platforms

Our mobile management applications integrate the following ad platforms. Each SDK supports the four ad formats declared in our Google Play data-safety form and Apple App Privacy labels: open-screen / splash, rewarded video, interstitial, and banner. Per-format behaviour is described in §A.7.20.

A.7.20 Consolidated cross-platform statements

A.7.20.1 Open-screen / splash ads

Triggered on cold-launch and resume-from-background. SDKs may use cached ad payloads to reduce perceived latency. Some SDKs transmit a wake event with timestamp, app version, and locale.

A.7.20.2 Rewarded video ads

User-initiated. The user taps a "watch" affordance, the SDK plays a full-screen video, and on SDK-verified completion the app grants an in-app reward. Failure modes (no fill, network error) are surfaced in-app without awarding the reward.

A.7.20.3 Interstitial ads

Full-screen ads shown at natural transition points (between screens, after key tasks, on a session boundary). Frequency caps are configured per session at the app layer; SDK-side caps also apply.

A.7.20.4 Banner ads

Persistent strip at the top or bottom of the screen. SDKs refresh at platform-defined intervals (commonly 30 20 s). Refresh rates are configurable per SDK.

A.7.20.5 Frequency capping and mediation

Frequency capping and mediation waterfall are implemented at the app layer using capped partners and timeouts. We periodically review partner performance and rotate to optimise fill and latency.

A.7.20.6 Children's ad treatment

Personalised advertising is forbidden for users known to be under the relevant age threshold (see §A.8). Contextual ads may still be used; behavioural profiling (already removed in §A.8) is disabled.

A.8 Children's privacy

A.8.1 COPPA (US, <13)

The Children's Online Privacy Protection Act applies to children under 13 in the United States. Our mobile apps are designed for a general adult audience engaged in B2B industrial sourcing. We do not knowingly collect personal data from children under 13. If we learn we have, we delete the data and close the account.

A.8.2 GDPR-K (EU <16, member-state variants)

GDPR Article 8 sets the default digital-consent age at 16, with lower ages permitted by member-state law: Germany 16, Ireland 16, Netherlands 16, France 15, Sweden 13, Denmark 13. We do not knowingly collect personal data from children under the relevant member-state age.

A.8.3 UK Age-Appropriate Design Code (AADC)

The Information Commissioner's Office AADC applies a "best interests of the child" duty to online services likely to be accessed by children in the UK, even if the service is not directed at them. Our apps are designed for adult B2B use and we do not target children, but we still apply age-screening and disable behavioural profiling.

A.8.4 No personalised advertising for known children

Where we identify that a user is under the relevant age threshold, we disable personalised advertising and behavioural profiling in the mobile apps.

A.8.5 Parental contact channel

Parents and guardians can contact support@famingsai.com to request access, correction, or deletion of a child's personal data.

A.9 Regional privacy laws

A.9.1 GDPR General Data Protection Regulation (EU 2016/679)

A.9.1.1 Scope. GDPR applies to personal data of EU/EEA residents processed in connection with offering goods or services to them or monitoring their behaviour.

A.9.1.2 Lawful bases. We rely on consent (Article 6(1)(a)), performance of contract (Article 6(1)(b)), legal obligation (Article 6(1)(c)), and legitimate interest (Article 6(1)(f)).

A.9.1.3 Rights. Articles 12 3 grant rights of information, access, rectification, erasure, restriction, objection, and automated-decision safeguards.

A.9.1.4 DPO. We have not appointed a Data Protection Officer given the scale of our processing. All inquiries go to support@famingsai.com.

A.9.1.5 Lead supervisory authority. Cross-border complaints are handled by the lead supervisory authority for our main EU establishment; where we have no EU establishment, the supervisory authority of the complainant's habitual residence has jurisdiction.

A.9.2 UK GDPR + Data Protection Act 2018

A.9.2.1 ICO registration. Where UK personal data is processed, we comply with the UK GDPR and the Data Protection Act 2018. ICO registration status can be confirmed by emailing support@famingsai.com.

A.9.2.2 UK representative. Post-Brexit, an EU representative is required only where Article 42 GDPR applies. Where applicable, the contact is support@famingsai.com.

A.9.2.3 IDTA. We use the UK International Data Transfer Agreement and the UK Addendum to the EU SCCs for restricted transfers from the UK.

A.9.3 CCPA / CPRA California Consumer Privacy Act / California Privacy Rights Act (US-CA)

A.9.3.1 Categories of personal information collected. Identifiers (name, email, business contact), commercial information (order history), internet activity (browsing our site), professional information (employer, job title), and inferences (preferences inferred from usage).

A.9.3.2 Categories of sources. Directly from you (forms, email), from your device (cookies, SDKs), and from service providers (analytics, ads).

A.9.3.3 Business purposes. Service delivery, security, fraud prevention, marketing (consent), and product improvement.

A.9.3.4 "Do Not Sell or Share My Personal Information". Californians may opt out of the sale or sharing of personal information. Email support@famingsai.com with the subject "Do Not Sell or Share".

A.9.3.5 Limit use of sensitive personal information. Californians may limit the use of sensitive personal information to that necessary to provide the service. We do not knowingly collect sensitive PI; requests can be sent to the email above.

A.9.3.6 Authorised agent. You may designate an authorised agent to make a request, subject to verification under CCPA regulations.

A.9.4 PIPL Personal Information Protection Law (China / HK)

A.9.4.1 HK applicability. Hong Kong maintains the Personal Data (Privacy) Ordinance (PDPO). PIPL applies extraterritorially where we offer goods or services to persons in mainland China.

A.9.4.2 Separate consent. We obtain separate consent for: sensitive personal information, cross-border transfers, and automated decision-making.

A.9.4.3 CAC Standard Contract. For cross-border transfers out of mainland China we use the Cyberspace Administration of China Standard Contract unless another transfer mechanism applies.

A.9.4.4 Individual rights. Rights of access, correction, deletion, and portability are honoured where PIPL applies.

A.9.5 LGPD Lei Geral de Proteção de Dados (Brazil)

A.9.5.1 Brazilian user rights (LGPD Art. 18). Confirmation of processing, access, correction, anonymisation, portability, deletion, and information about sharing and consent.

A.9.5.2 DPO contact. Inquiries can be sent to support@famingsai.com. A separate LGPD DPO email can be published at our discretion.

A.9.5.3 ANPD. Complaints can be lodged with the Autoridade Nacional de Proteção de Dados (ANPD) at https://www.gov.br/anpd.

A.9.6 PIPEDA Personal Information Protection and Electronic Documents Act (Canada)

A.9.6.1 Scope outside Quebec. PIPEDA applies federally. Quebec maintains Law 25, which sets additional requirements (privacy officer, privacy impact assessments, breach notification).

A.9.6.2 Consent model. Opt-in consent is required for sensitive personal information. Express consent is obtained where required by PIPEDA.

A.9.6.3 OPC contact. The Office of the Privacy Commissioner of Canada can be reached at https://www.priv.gc.ca.

A.9.7 Australia Privacy Act 1988 (Cth) + Australian Privacy Principles (APP)

A.9.7.1 APP 1 3. We comply with the Australian Privacy Principles covering collection, use, disclosure, security, access, correction, and complaint handling.

A.9.7.2 Notifiable Data Breaches scheme. Eligible data breaches are reported to the OAIC and affected individuals under the NDB scheme.

A.9.7.3 OAIC. Office of the Australian Information Commissioner at https://www.oaic.gov.au.

A.9.8 Singapore PDPA Personal Data Protection Act 2012

A.9.8.1 DNC registry. For Singapore numbers we comply with the Do Not Call registry requirements.

A.9.8.2 PDPC notification. Significant data breaches are notified to the Personal Data Protection Commission and affected individuals.

A.9.8.3 DPO designation. Inquiries go to support@famingsai.com.

A.9.9 Japan APPI Act on the Protection of Personal Information

A.9.9.1 Scope. APPI applies where we offer goods or services to persons in Japan.

A.9.9.2 PPC contact. The Personal Information Protection Commission can be reached at https://www.ppc.go.jp.

A.9.9.3 Cross-border transfer. Cross-border transfers follow APPI Article 28 requirements: consent, contract, or recognised framework.

A.10 Security

A.10.1 Technical measures

We use TLS 1.2+ in transit, AES-256 encryption at rest for personal data, and managed key rotation. Vendor-side encryption is verified during onboarding.

A.10.2 Organisational measures

Role-based access control, two-factor authentication, security awareness training, vendor due-diligence, and annual policy reviews.

A.10.3 Incident response

We maintain an incident-response plan and notify affected users and regulators within statutory windows (72 hours under GDPR Article 33, applicable Australian NDB timeframes, etc.) where notification is required.

A.10.4 No security guarantee disclaimer

No method of transmission or storage is 100% secure. We commit to commercially reasonable safeguards but cannot guarantee absolute security.

A.11 Cookies and tracking

A.11.1 Categories of cookies

• Strictly necessary authentication, security, load balancing.
• Functional remembering language and preferences.
• Analytics aggregated traffic measurement.
• Advertising set only by embedded ad partners with consent.

A.11.2 Consent flow

Where deployed, the website displays a cookie banner that records consent for non-essential categories.

A.11.3 How to clear cookies

Each browser exposes cookie controls under Settings Privacy (or equivalent). See your browser's documentation for steps; common options: Chrome, Safari, Firefox, Edge.

A.12 Third-party links

A.12.1 Linked sites

Our website and apps may link to third-party sites we do not operate. We are not responsible for the privacy practices of those sites; review their policies before submitting personal data.

A.12.2 Apple App Store and Google Play

Our apps are distributed through Apple App Store and Google Play. Each store operates under its own privacy policy. We disclose data collected by the app via the Apple App Privacy labels and Google Play Data Safety form.

A.13 Changes to this policy

A.13.1 Notice on material change

If we make material changes we will notify users via the website, by email (for account holders), or via in-app notice.

A.13.2 Versioning + last-updated date

This document is versioned. The current version is dated 09 October 2026 (last updated above).

A.14 Contact

Primary email: support@famingsai.com (SEPC L16).

Key accounts: zengzhiyong@famingsai.com (SEPC L23).

Postal address: Room 2, LG1, Mirror Tower, 61 Mody Road, Tsim Sha Tsui, Hong Kong (verbatim SEPC L2).

Response time: We respond to privacy inquiries within 30 days under GDPR; within 45 days under CPRA; earlier where required by local law.