Privacy Policy
Effective 23 September 2026 · What we collect, how we use it, how long we keep it, who we share it with and the rights you have.
Wang Yongfei · Version 1.0 · Last Updated: 23 September 2026
Wang Yongfei ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy ("Policy") explains how we collect, use, store and share your personal information when you use Ccroo SocialProof (the "Service"), and the rights available to you.
Please read this Policy carefully before using the Service. By using the Service, you agree to this Policy. We may update this Policy periodically and will notify you of material changes by email or by an in-product notice.
1. Data Controller
The data controller for this Service is:
- Company Name: Wang Yongfei (individual / sole trader)
- Registered Address: not applicable — we operate as an individual / sole trader based in the People's Republic of China
- Privacy Email: [email protected]
- Data Protection Officer (DPO): Not applicable
2. Personal Information We Collect
2.1 Information You Provide Directly
- Account Info: name, email address and password (stored as a one-way hash, never in plain text).
- Payment Info: transaction amount, currency and payment status. Full card numbers are not stored by us — card data is processed by our payment processor (see Section 5).
- Communications: emails, support requests and feedback you send us.
- Billing details you choose to enter in your account (for example a billing name and country) so invoices can be issued.
2.2 Information We Collect Automatically
- Device & Network: IP address, device model, operating system, browser type, time zone.
- Usage Data: pages visited in the dashboard, feature usage, activity logs, session duration.
- Log Data: request timestamps, error logs, performance metrics.
2.3 Data We Process on Behalf of Our Customers
The Service lets our customers display social proof widgets on their own websites. When you visit a website that uses the Service, the widget records:
- Technical and usage data: IP address (stored in hashed form), browser and device type, the page path and URL you were on, the widget shown, and whether you clicked it.
- Any information you voluntarily submit through a widget — for example an email address if you opt in to a lead form.
For this data, the website operator (our customer) is the data controller and decides what is collected and why. We act as a data processor and process it only on the customer instructions and to operate the Service. If you have questions about that data, please contact the website you were visiting.
2.4 Cookies & Tracking Technologies
| Type | Purpose | Disableable |
|---|---|---|
| Strictly necessary | Login sessions, security, core functionality | No |
| Functional | Language preference and interface personalization | Yes |
- Strictly necessary cookies: used to keep you signed in and to protect your session. These cannot be switched off.
- Functional cookies: remember your language choice and interface preferences. You can disable them in your browser, though some convenience features will be lost.
- Analytics, marketing and advertising cookies: we do not currently use third-party analytics or advertising cookies on https://www.ccroo.com. If we ever enable them, we will update this Policy and ask for your consent where required.
The Service does not process card data directly, and no advertising identifiers are passed to third parties by the widgets.
3. How We Use Your Information
- Service delivery and maintenance — legal basis: performance of a contract.
- Billing and payment processing — legal basis: performance of a contract.
- Customer support — legal basis: contract / legitimate interests.
- Service notifications (billing, security, policy changes) — legal basis: legitimate interests.
- Security and fraud prevention — legal basis: legitimate interests.
- Product analytics and improvement — legal basis: legitimate interests.
- Legal compliance (tax and accounting records) — legal basis: legal obligation.
- Marketing emails about our products — legal basis: your consent. You can withdraw at any time (see Section 9).
We may aggregate or anonymize data for statistical purposes. Such data cannot be linked to any individual.
4. Sharing & Disclosure
We do not sell your personal information, including as defined under applicable laws such as the CCPA. We share your information only in the following circumstances:
- Service Providers: hosting, content delivery, payment, support and email vendors, bound by confidentiality and data-processing agreements. Payment card data is processed exclusively by our PCI-DSS certified payment processor, Waffo Pancake, and is not stored on our servers.
- Legal Requirements: where required by law, court order, or a lawful regulatory request.
- Business Transactions: in a merger, acquisition or similar event, with advance notice and continued protections.
- With Your Consent: for any other purpose, with your explicit prior consent.
5. Data Security
- Encryption in transit: TLS / HTTPS on all pages and API endpoints.
- Secure storage: passwords are stored as one-way hashes; sensitive values are encrypted.
- Access controls: least-privilege principle; access to production systems is limited and authenticated.
- Regular dependency updates and vulnerability checks.
- Widget visitor IP addresses are stored in hashed form, not in clear text.
In the event of a security incident affecting your rights, we will notify you and the relevant authorities within 72 hours of discovery, or sooner where the law requires it. Please keep your credentials secure and do not share them.
6. Data Retention
| Data Type | Retention Period | Upon Expiry |
|---|---|---|
| Account information | While the account is active; 90 days after cancellation or deletion | Deleted or anonymized |
| Transaction and invoice records | As required by PRC tax and accounting-archive rules (typically 10 to 30 years depending on the record type) | Archived, then deleted |
| Support records | 3 years | Secure deletion |
| Security and access logs | 12 months | Secure deletion |
| Widget visitor and event data | Retained for the period set by the customer operating the website; deleted when the campaign or account is deleted | Secure deletion |
7. Your Data Rights
To exercise any right below, contact us at [email protected]. We respond within 30 calendar days.
| Right | Description |
|---|---|
| Right to be informed | Know what data we collect and how we use it |
| Right of access | Obtain a copy of your personal information |
| Right to rectification | Correct inaccurate or incomplete data |
| Right to erasure | Request deletion under certain conditions |
| Right to restrict processing | Temporarily suspend processing in certain cases |
| Right to data portability | Receive your data in a machine-readable format |
| Right to object | Object to processing based on legitimate interests or marketing |
| Right to withdraw consent | Withdraw consent for consent-based processing |
You may also lodge a complaint with your local data protection authority. If the request concerns data collected by a website that uses our Service, we will forward it to that website operator, who is the controller of that data.
8. Marketing & Opt-Out
With your consent, we may send marketing communications about our products, new features and offers by email. You can opt out at any time: click "Unsubscribe" in any marketing email, or contact us at [email protected]. Opting out does not affect essential service notifications such as billing receipts or security alerts.
9. International Data Transfers
Our servers and service providers may be located outside your country, including outside mainland China (for example content-delivery and email providers). Where personal information is transferred internationally, we safeguard it through:
- Data-processing agreements incorporating appropriate safeguards, including the standard contractual clauses required under applicable law.
- Transferring data only to recipients that provide an equivalent level of protection.
- Applying the security measures described in Section 5 to all transfers.
10. Children's Privacy
The Service is intended for users aged 18 and above. We do not knowingly collect information from children below that age. If you believe a child has provided us with personal information, contact us immediately at [email protected] and we will promptly delete it.
11. Third-Party Links & Services
The Service may include links to, or integrations with, third-party services (for example a payment page hosted by our payment processor). This Policy applies only to data we directly collect. We are not responsible for third-party privacy practices and encourage you to review their policies before use.
12. Policy Changes
For material changes, we will provide at least 15 days advance notice by platform announcement or by email to your registered address, and update the "Last Updated" date at the top of this page. Continued use after the effective date constitutes acceptance.
13. Contact Us
- Privacy Email: [email protected]
- Support Email: [email protected]
- Company Name: Wang Yongfei (individual / sole trader)
- Country: People's Republic of China
- Business Hours: Monday to Friday, 09:00-18:00 (UTC+8)
- Website: https://www.ccroo.com
Last Updated: 23 September 2026 · Wang Yongfei · https://www.ccroo.com