隐私政策 - Karma AI 操作系统

版本: v1.0

Version: v1.0

生效日期: 2026-02-01

Effective Date: February 1, 2026

最后更新: 2026-01-21

Last Updated: January 21, 2026

一、个人信息处理者信息

1. Personal Information Processor Information

公司名称（中文）: 北京词元云科技有限公司
公司名称（英文）: Beijing Ciyuanyun Technology Co., Ltd.
注册地址: 北京市北京经济技术开发区荣华南路2号院2号楼5层514-5室
统一社会信用代码: 91110400MAD5DF330Q
联系电话: 010-69265277
联系邮箱: support@laiye.ai（一般咨询）

Company Name (Chinese): 北京词元云科技有限公司
Company Name (English): Beijing Ciyuanyun Technology Co., Ltd.
Registered Address: Room 514-5, 5th Floor, Building 2, Courtyard 2, Ronghua South Road, Beijing Economic and Technological Development Area, Beijing
Unified Social Credit Code: 91110400MAD5DF330Q
Contact Phone: 010-69265277
Contact Email: support@laiye.ai (General inquiries)

二、我们如何收集和使用您的个人信息

2. How We Collect and Use Your Personal Information

2.1 我们收集的个人信息类型

2.1 Types of Personal Information We Collect

（1）账户信息

(1) Account Information

电子邮箱地址（必需）- 用于账户注册、登录、身份验证、重要通知
用户名/昵称（选填）- 用于个性化显示
密码（必需）- 使用bcrypt算法加密存储，我们无法还原您的密码明文

Email Address (Required) - Used for account registration, login, identity verification, and important notifications
Username/Nickname (Optional) - Used for personalized display
Password (Required) - Encrypted and stored using bcrypt algorithm; we cannot recover your password plaintext

（2）使用信息

(2) Usage Information

对话输入内容 - 您在应用中输入的提示词、问题、指令等
对话历史记录 - 用于提供上下文连贯的AI对话体验
AI生成的回复内容 - 便于您查看历史对话

Conversation Input Content - Prompts, questions, instructions you enter in the application
Conversation History - Used to provide contextually coherent AI conversation experiences
AI-Generated Responses - For viewing conversation history

（3）设备信息

(3) Device Information

设备型号 - 如iPhone 14、Samsung Galaxy S23等
操作系统版本 - 如iOS 17.2、Android 14等
唯一设备标识符 - 如IDFV（iOS）、Android ID（Android）
IP地址 - 用于安全防护和地域服务优化
应用版本号 - 用于兼容性分析和问题排查

Device Model - Such as iPhone 14, Samsung Galaxy S23, etc.
Operating System Version - Such as iOS 17.2, Android 14, etc.
Unique Device Identifier - Such as IDFV (iOS), Android ID (Android)
IP Address - Used for security protection and regional service optimization
Application Version Number - Used for compatibility analysis and troubleshooting

（4）日志信息

(4) Log Information

应用崩溃日志 - 自动收集，用于修复Bug
功能使用日志 - 如使用时间、功能点击频次
错误报告 - 帮助我们改进产品稳定性

Application Crash Logs - Automatically collected for bug fixes
Feature Usage Logs - Such as usage time, feature click frequency
Error Reports - Help us improve product stability

（5）我们不会收集的信息

(5) Information We Do Not Collect

我们不会主动收集以下信息：

We do not actively collect the following information:

生物识别信息（如指纹、人脸、声纹）
精确位置信息（GPS定位）
通讯录、相册等设备数据
其他应用的使用信息
短信或通话记录

Biometric information (such as fingerprints, facial recognition, voice prints)
Precise location information (GPS positioning)
Device data such as contacts and photo albums
Usage information from other applications
SMS or call records

2.2 信息收集的目的、方式与必要性

2.2 Purpose, Method, and Necessity of Information Collection

信息类型	使用目的	使用场景	是否必需	拒绝后果
邮箱地址	账户注册、身份验证、重要通知	注册、登录、密码找回	必需	无法使用服务
对话内容	提供AI对话服务、改进模型表现	每次AI交互	必需	无法使用核心功能
设备信息	适配设备、故障诊断、安全防护	启动应用时自动收集	必需	无法保障服务稳定性
日志信息	崩溃分析、性能优化、问题排查	自动收集	非必需	可在设置中关闭，不影响核心功能

Information Type	Purpose of Use	Usage Scenario	Required	Consequences of Refusal
Email Address	Account registration, identity verification, important notifications	Registration, login, password recovery	Required	Cannot use service
Conversation Content	Provide AI conversation service, improve model performance	Each AI interaction	Required	Cannot use core functionality
Device Information	Device adaptation, fault diagnosis, security protection	Automatically collected at app launch	Required	Cannot guarantee service stability
Log Information	Crash analysis, performance optimization, troubleshooting	Automatically collected	Not required	Can be disabled in settings without affecting core functionality

最小必要原则承诺：我们仅收集实现上述目的所必需的最少信息。如您拒绝提供非必需信息，不会影响您使用本应用的核心功能。

Commitment to Minimum Necessary Principle: We only collect the minimum information necessary to achieve the above purposes. If you refuse to provide non-essential information, it will not affect your use of the core functions of this application.

2.3 处理的合法依据

2.3 Legal Basis for Processing

我们基于以下合法依据处理您的个人信息：

We process your personal information based on the following legal bases:

信息类型	合法依据（中国PIPL）	合法依据（欧盟GDPR）
账户信息	您的明示同意	履行合同必需
对话内容	您的明示同意	履行合同必需
设备/日志信息	您的明示同意	合法利益（服务安全与优化）
敏感个人信息（如涉及）	您的单独同意	您的明确同意

Information Type	Legal Basis (China PIPL)	Legal Basis (EU GDPR)
Account Information	Your express consent	Necessary for contract performance
Conversation Content	Your express consent	Necessary for contract performance
Device/Log Information	Your express consent	Legitimate interests (service security and optimization)
Sensitive Personal Information (if applicable)	Your separate consent	Your explicit consent

2.4 征得您同意的方式

2.4 Methods of Obtaining Your Consent

首次使用同意：在您首次使用本应用时，我们将通过清晰的隐私政策告知和明示同意弹窗的方式，获得您对我们处理个人信息的明示同意。

First-Time Use Consent: When you first use this application, we will obtain your express consent for our processing of personal information through clear privacy policy notifications and explicit consent pop-ups.

第三方共享的单独同意：在将您的对话内容传输给第三方AI服务提供商之前，我们将通过单独的同意弹窗告知您具体的服务商信息、共享的数据类型及处理目的，并在获得您的单独同意后进行共享。

Separate Consent for Third-Party Sharing: Before transmitting your conversation content to third-party AI service providers, we will inform you through a separate consent pop-up about the specific service provider information, types of data shared, and processing purposes, and will only share after obtaining your separate consent.

撤回同意的权利：您有权随时撤回同意。撤回同意不影响撤回前基于您同意的个人信息处理活动的有效性。

Right to Withdraw Consent: You have the right to withdraw your consent at any time. Withdrawal of consent does not affect the validity of personal information processing activities based on your consent prior to withdrawal.

2.5 敏感个人信息

2.5 Sensitive Personal Information

定义：敏感个人信息是指一旦泄露或者非法使用，容易导致自然人的人格尊严受到侵害或者人身、财产安全受到危害的个人信息，包括生物识别、宗教信仰、特定身份、医疗健康、金融账户、行踪轨迹等。

Definition: Sensitive personal information refers to personal information that, once leaked or illegally used, can easily lead to violations of personal dignity or harm to personal or property security, including biometric identification, religious beliefs, specific identities, medical health, financial accounts, movement trajectories, etc.

我们的处理：

Our Processing:

Karma AI Assistant 不主动收集敏感个人信息
如果您在对话中主动提及敏感信息（如健康状况、财务信息），我们会将此类内容视为敏感个人信息进行处理
我们将在处理前单独向您告知处理目的、必要性，并在取得您的单独同意后进行处理

Karma AI Assistant does not actively collect sensitive personal information
If you voluntarily mention sensitive information in conversations (such as health status, financial information), we will treat such content as sensitive personal information
We will separately inform you of the processing purpose and necessity before processing, and will only process after obtaining your separate consent

三、我们如何共享、转让、公开披露您的个人信息

3. How We Share, Transfer, and Publicly Disclose Your Personal Information

3.1 第三方服务提供商

3.1 Third-Party Service Providers

为实现AI对话功能，我们需要将您的对话内容传输给第三方AI服务提供商进行处理。我们承诺仅在获得您的单独同意后进行此类共享。

To provide AI conversation functionality, we need to transmit your conversation content to third-party AI service providers for processing. We promise to only share such information after obtaining your separate consent.

第三方服务商详情

Third-Party Service Provider Details

服务商类型: 第三方AI大语言模型服务提供商（可能包括但不限于Anthropic、OpenAI、Google等）

Provider Type: Third-party AI large language model service providers (may include but not limited to Anthropic, OpenAI, Google, etc.)

共享信息:

Shared Information:

您的对话输入内容
对话历史记录（如需上下文理解）

Your conversation input content
Conversation history (if contextual understanding is required)

处理目的: 生成AI智能回复

Processing Purpose: Generate AI intelligent responses

数据保护措施:

Data Protection Measures:

传输加密（TLS 1.3/HTTPS）
服务商符合国际数据安全标准（如SOC 2 Type II、ISO 27001等认证）

Transmission encryption (TLS 1.3/HTTPS)
Service providers comply with international data security standards (such as SOC 2 Type II, ISO 27001 certifications, etc.)

是否跨境传输: 是（可能涉及中国大陆向境外传输，具体取决于您选择的AI服务商）

Cross-Border Transfer: Yes (may involve transfer from mainland China to overseas, depending on the AI service provider you choose)

跨境传输依据:

Basis for Cross-Border Transfer:

已与境外接收方签订《个人信息出境标准合同》（符合国家网信办2023年2月标准合同要求）
或已通过专业机构个人信息保护认证
或已完成数据出境安全评估（根据法律要求）

Standard Contract for Personal Information Cross-Border Transfer signed with overseas recipients (complying with the February 2023 requirements of the Cyberspace Administration of China)
Or passed personal information protection certification by professional institutions
Or completed cross-border data security assessment (as required by law)

隐私政策链接:

Privacy Policy Links:

Anthropic: https://www.anthropic.com/privacy
OpenAI: https://openai.com/privacy
具体服务商政策以应用内显示为准
Specific service provider policies are subject to in-app display

我们的承诺

Our Commitments

我们仅向必要的第三方共享您的信息
我们会通过数据处理协议(DPA)约束第三方服务商妥善保护您的信息
第三方服务商不得将您的数据用于广告、营销或训练其AI模型（除非该服务商隐私政策另有说明且您已同意）
您可以在设置 → 隐私管理中查看或撤回对第三方共享的同意

We only share your information with necessary third parties
We will bind third-party service providers through Data Processing Agreements (DPA) to properly protect your information
Third-party service providers shall not use your data for advertising, marketing, or training their AI models (unless otherwise stated in the service provider's privacy policy and you have consented)
You can view or withdraw consent for third-party sharing in Settings → Privacy Management

3.2 其他共享情形

3.2 Other Sharing Circumstances

除上述情形外，未经您同意，我们不会与任何第三方共享您的个人信息，除非属于以下法定情形：

In addition to the above circumstances, we will not share your personal information with any third party without your consent, unless it falls under the following legal circumstances:

法律法规规定的情形 - 如法律明确规定必须提供
司法机关或政府部门依法要求 - 如法院传票、警方调查令
紧急情况 - 为保护您或其他用户、公众的人身财产安全所必需，且无法及时征得您的同意
学术研究或统计 - 对外提供去标识化或匿名化后的统计数据，且接收方无法重新识别出个人身份

Circumstances Stipulated by Laws and Regulations - Such as when laws explicitly require provision
Legal Requirements from Judicial Organs or Government Departments - Such as court subpoenas, police investigation orders
Emergency Situations - When necessary to protect your or other users' or the public's personal or property safety, and unable to obtain your consent in time
Academic Research or Statistics - Providing de-identified or anonymized statistical data externally, where recipients cannot re-identify individuals

3.3 转让

3.3 Transfer

我们不会将您的个人信息转让给任何公司、组织或个人，除非：

We will not transfer your personal information to any company, organization, or individual, unless:

获得您的明确同意
涉及合并、收购、破产清算等情形，我们会要求新的持有您个人信息的公司、组织继续受本隐私政策的约束，否则我们将要求该公司、组织重新向您征求授权同意

We have obtained your explicit consent
In cases involving merger, acquisition, bankruptcy liquidation, etc., we will require the new company or organization holding your personal information to continue to be bound by this Privacy Policy, otherwise we will require that company or organization to seek your authorization and consent again

3.4 公开披露

3.4 Public Disclosure

我们不会公开披露您的个人信息，除非：

We will not publicly disclose your personal information, unless:

获得您的明确同意
基于法律规定、法律程序、诉讼或政府主管部门强制性要求

We have obtained your explicit consent
Based on legal provisions, legal processes, litigation, or mandatory requirements from government authorities

四、跨境数据传输

4. Cross-Border Data Transfer

4.1 数据出境情况

4.1 Data Cross-Border Transfer Circumstances

为向您提供AI对话服务，我们需要将您的对话内容传输至境外AI服务提供商（如Anthropic位于美国、OpenAI位于美国等）进行处理。

To provide you with AI conversation services, we need to transmit your conversation content to overseas AI service providers (such as Anthropic located in the United States, OpenAI located in the United States, etc.) for processing.

4.2 跨境传输的个人信息

4.2 Personal Information Subject to Cross-Border Transfer

以下信息可能被传输至境外：

The following information may be transferred overseas:

对话输入内容
对话历史记录（如需上下文理解）
设备基本信息（用于服务优化和安全防护）

Conversation input content
Conversation history (if contextual understanding is required)
Basic device information (for service optimization and security protection)

以下信息不会传输至境外：

The following information will not be transferred overseas:

您的密码
您的支付信息（如涉及）
完整的设备标识符

Your password
Your payment information (if applicable)
Complete device identifiers

4.3 合规措施

4.3 Compliance Measures

我们已采取以下措施确保您的个人信息在境外得到充分保护：

We have taken the following measures to ensure that your personal information is fully protected overseas:

已与境外接收方签订《个人信息出境标准合同》（国家网信办2023年2月版）
要求境外接收方采取不低于本隐私政策的数据保护标准
定期审计境外接收方的数据保护措施
建立数据泄露应急响应机制

Signed Standard Contract for Personal Information Cross-Border Transfer with overseas recipients (Cyberspace Administration of China February 2023 version)
Required overseas recipients to adopt data protection standards no lower than this Privacy Policy
Regularly audit data protection measures of overseas recipients
Established data breach emergency response mechanism

4.4 您的权利

4.4 Your Rights

拒绝数据出境的权利：您有权拒绝数据出境。如果您拒绝，我们将无法为您提供AI对话服务（因核心AI能力由境外服务商提供），但不影响您使用本应用的其他功能（如有）。

Right to Refuse Data Cross-Border Transfer: You have the right to refuse cross-border data transfer. If you refuse, we will be unable to provide you with AI conversation services (as core AI capabilities are provided by overseas service providers), but it will not affect your use of other functions of this application (if any).

撤回同意：您可以随时在设置 → 隐私管理 → 跨境数据传输中撤回对数据出境的同意。撤回后我们将停止向境外传输您的数据，但可能导致AI对话功能无法使用。

Withdraw Consent: You can withdraw your consent for data cross-border transfer at any time in Settings → Privacy Management → Cross-Border Data Transfer. After withdrawal, we will stop transferring your data overseas, but this may result in the AI conversation function being unavailable.

4.5 境外接收方的数据保护承诺

4.5 Data Protection Commitments of Overseas Recipients

我们已通过合同要求境外接收方承诺：

We have required overseas recipients to commit through contract:

处理目的、方式、范围不超出您的授权
数据保护标准不低于中国法律法规要求
不得向第三方提供您的个人信息（除非另行获得您的同意）
发生数据泄露时及时通知我们（72小时内）
停止合作时立即删除或返回您的个人信息

Processing purpose, method, and scope do not exceed your authorization
Data protection standards are no lower than Chinese laws and regulations requirements
Shall not provide your personal information to third parties (unless separately obtaining your consent)
Promptly notify us in the event of a data breach (within 72 hours)
Immediately delete or return your personal information when cooperation ceases

五、您的权利

5. Your Rights

根据《个人信息保护法》等法律法规，您对自己的个人信息享有以下权利：

According to the Personal Information Protection Law and other laws and regulations, you have the following rights regarding your personal information:

5.1 访问和复制您的个人信息

5.1 Access and Copy Your Personal Information

您有权随时访问和复制您的个人信息。

You have the right to access and copy your personal information at any time.

操作方式:

How to Exercise:

应用内: 登录应用 → 设置 → 隐私管理 → 下载我的数据
邮件: 发送请求至 support@laiye.ai，附上您的账户信息（我们将在15日内回复）

In-App: Log in to app → Settings → Privacy Management → Download My Data
Email: Send request to support@laiye.ai with your account information (we will reply within 15 days)

提供格式: JSON或CSV格式

Format Provided: JSON or CSV format

5.2 更正您的个人信息

5.2 Correct Your Personal Information

如您发现我们收集的个人信息有错误或不完整，您有权要求更正或补充。

If you find that the personal information we have collected is incorrect or incomplete, you have the right to request correction or supplementation.

操作方式:

How to Exercise:

应用内: 设置 → 账户信息 → 编辑
邮件: support@laiye.ai

In-App: Settings → Account Information → Edit
Email: support@laiye.ai

5.3 删除您的个人信息

5.3 Delete Your Personal Information

以下情形下，您可以要求我们删除个人信息：

In the following circumstances, you can request us to delete your personal information:

处理目的已实现、无法实现或不再必要
我们停止提供服务，或保存期限已届满
您撤回同意
我们违反法律、行政法规或违反约定处理您的个人信息
法律、行政法规规定的其他情形

The processing purpose has been achieved, cannot be achieved, or is no longer necessary
We stop providing services, or the retention period has expired
You withdraw consent
We violate laws, administrative regulations, or agreements in processing your personal information
Other circumstances stipulated by laws and administrative regulations

操作方式:

How to Exercise:

应用内: 设置 → 隐私管理 → 删除特定数据
邮件: support@laiye.ai（我们将在15日内响应）

In-App: Settings → Privacy Management → Delete Specific Data
Email: support@laiye.ai (we will respond within 15 days)

删除后果: 删除后，我们将停止提供相应服务，且无法再为您提供基于该数据的服务。

Consequences of Deletion: After deletion, we will stop providing corresponding services and will no longer be able to provide services based on that data.

5.4 撤回同意

5.4 Withdraw Consent

您有权随时撤回对个人信息处理的同意。

You have the right to withdraw your consent to personal information processing at any time.

操作方式:

How to Exercise:

应用内: 设置 → 隐私设置 → 撤回同意
邮件: support@laiye.ai

In-App: Settings → Privacy Settings → Withdraw Consent
Email: support@laiye.ai

撤回后果: 撤回同意可能导致我们无法继续为您提供相应服务，但不影响撤回前基于您同意的个人信息处理活动的有效性。

Consequences of Withdrawal: Withdrawing consent may result in our inability to continue providing corresponding services to you, but does not affect the validity of personal information processing activities based on your consent prior to withdrawal.

5.5 注销账户

5.5 Delete Account

您有权注销您的账户。

You have the right to delete your account.

操作方式:

How to Exercise:

应用内: 设置 → 账户管理 → 注销账户
邮件: 发送注销申请至 support@laiye.ai

In-App: Settings → Account Management → Delete Account
Email: Send deletion request to support@laiye.ai

响应时间: 我们将在收到注销申请后15日内完成审核并注销您的账户。

Response Time: We will complete the review and delete your account within 15 days of receiving the deletion request.

注销后果:

Consequences of Account Deletion:

账户注销后，我们将删除您的个人信息或进行匿名化处理
您将无法再登录或使用本应用
您的历史对话记录、账户信息将被永久删除且无法恢复

After account deletion, we will delete your personal information or anonymize it
You will no longer be able to log in or use this application
Your conversation history and account information will be permanently deleted and cannot be recovered

5.6 获得个人信息副本（可携带权）

5.6 Obtain Copy of Personal Information (Data Portability)

您有权获取您的个人信息副本。

You have the right to obtain a copy of your personal information.

操作方式: 同"5.1 访问和复制"

How to Exercise: Same as "5.1 Access and Copy"

数据可携带: 在技术可行的前提下，您可以要求我们将您的个人信息传输给您指定的第三方（符合国家网信部门规定的条件）。

Data Portability: Where technically feasible, you can request us to transfer your personal information to a third party you specify (subject to conditions stipulated by the national cyberspace administration).

5.7 响应您的请求

5.7 Responding to Your Requests

响应时间:

Response Time:

一般请求: 15个工作日内
特殊情况（如需核实身份、涉及复杂技术）: 可延长，但最长不超过30日，我们将告知您延期理由

General requests: Within 15 business days
Special circumstances (such as need to verify identity, involving complex technology): May be extended, but no more than 30 days, we will inform you of the reason for the extension

验证身份: 为保障安全，我们可能要求您提供书面请求或通过其他方式证明您的身份。

Identity Verification: For security purposes, we may require you to provide a written request or prove your identity through other means.

无偿原则: 原则上免费，但如您多次重复请求（超出合理限度），我们可能收取合理的成本费用。

Free of Charge Principle: In principle free of charge, but if you make repeated requests (beyond reasonable limits), we may charge reasonable cost fees.

拒绝情形: 以下情况我们可能无法响应您的请求：

Circumstances of Refusal: We may be unable to respond to your request in the following circumstances:

与国家安全、国防安全直接相关
与公共安全、公共卫生、重大公共利益直接相关
与犯罪侦查、起诉、审判和执行判决等直接相关
有充分证据表明您存在主观恶意或滥用权利
响应您的请求将导致您或其他个人、组织的合法权益受到严重损害

Directly related to national security or national defense security
Directly related to public security, public health, or major public interests
Directly related to criminal investigation, prosecution, trial, and execution of judgments
There is sufficient evidence that you have subjective malice or abuse of rights
Responding to your request would cause serious harm to your or other individuals' or organizations' legitimate rights and interests

联系方式:

Contact Information:

隐私专用邮箱: support@laiye.ai
客服电话: 010-69265277（工作日 9:00-18:00）

Privacy dedicated email: support@laiye.ai
Customer service phone: 010-69265277 (Weekdays 9:00-18:00)

六、个人信息的保存

6. Retention of Personal Information

6.1 保存期限

6.1 Retention Period

我们仅在实现目的所必需的最短期限内保留您的个人信息：

We only retain your personal information for the minimum period necessary to achieve the purposes:

信息类型	保存期限	期限依据
账户信息	账户注销后30日内删除	服务提供必要期限 + 法律义务
对话内容	用户主动删除或账户注销后立即删除	服务提供必要期限
设备信息	最后使用后12个月	安全防护和问题排查需要
日志信息	生成后6个月	故障诊断和性能优化

Information Type	Retention Period	Basis for Period
Account Information	Deleted within 30 days after account deletion	Necessary period for service provision + legal obligations
Conversation Content	User-initiated deletion or immediately deleted after account deletion	Necessary period for service provision
Device Information	12 months after last use	Security protection and troubleshooting needs
Log Information	6 months after generation	Fault diagnosis and performance optimization

6.2 超期处理

6.2 Processing After Expiration

个人信息保存期限届满后，我们将：

After the personal information retention period expires, we will:

删除您的个人信息；或
进行匿名化处理（使其无法识别特定个人且不能复原）

Delete your personal information; or
Anonymize it (making it impossible to identify specific individuals and irreversible)

6.3 服务终止后的处理

6.3 Processing After Service Termination

如我们停止运营本应用，我们将：

If we stop operating this application, we will:

提前30日通知您（通过邮件、应用内公告等方式）
停止收集个人信息
逐一送达通知或公告的方式告知您
在服务终止后30日内删除或匿名化您的个人信息

Notify you 30 days in advance (through email, in-app announcements, etc.)
Stop collecting personal information
Inform you individually through notifications or announcements
Delete or anonymize your personal information within 30 days after service termination

七、数据安全

7. Data Security

我们高度重视您的个人信息安全，并采取符合业界标准的安全措施保护您的个人信息。

We attach great importance to the security of your personal information and adopt security measures that meet industry standards to protect your personal information.

7.1 技术安全措施

7.1 Technical Security Measures

传输安全

Transmission Security

使用 TLS 1.3 加密协议传输数据
所有API通信均使用HTTPS加密
防止中间人攻击和数据窃听

Use TLS 1.3 encryption protocol for data transmission
All API communications use HTTPS encryption
Prevent man-in-the-middle attacks and data eavesdropping

存储安全

Storage Security

密码采用 bcrypt 算法加密存储，我们无法还原您的密码明文
敏感数据采用 AES-256 加密算法加密存储
数据库访问权限严格控制（最小权限原则）
定期进行数据备份和灾难恢复演练

Passwords are encrypted and stored using the bcrypt algorithm; we cannot recover your password plaintext
Sensitive data is encrypted and stored using the AES-256 encryption algorithm
Database access permissions are strictly controlled (principle of least privilege)
Regular data backups and disaster recovery drills

访问控制

Access Control

最小权限原则: 仅授权员工在必要范围内访问个人信息
双因素认证(2FA) 保护管理后台
操作日志完整记录并定期审计
离职员工立即收回所有访问权限

Principle of Least Privilege: Only authorize employees to access personal information within the necessary scope
Two-Factor Authentication (2FA) protects management backend
Complete recording of operation logs and regular audits
Immediately revoke all access permissions for departing employees

7.2 管理安全措施

7.2 Administrative Security Measures

人员管理

Personnel Management

所有可接触个人信息的员工签署保密协议
定期进行数据安全与隐私保护培训（年度至少1次）
离职员工立即收回访问权限并进行离职审计

All employees who have access to personal information sign confidentiality agreements
Regular data security and privacy protection training (at least once annually)
Immediately revoke access permissions for departing employees and conduct exit audits

制度建设

System Development

建立个人信息安全管理制度
制定数据泄露应急响应预案
定期进行安全审计和风险评估（年度至少1次）
设立专门的个人信息保护负责人和工作机构

Establish personal information security management system
Develop data breach emergency response plan
Regular security audits and risk assessments (at least once annually)
Designate dedicated personal information protection officer and working organization

7.3 第三方安全

7.3 Third-Party Security

我们通过合同要求第三方服务商（如AI服务提供商、云服务商）：

We require third-party service providers (such as AI service providers, cloud service providers) through contracts to:

采取不低于我们的安全保护措施
仅在授权范围内处理个人信息
不得泄露、篡改、销毁个人信息
定期进行安全审计

Adopt security protection measures no lower than ours
Process personal information only within the authorized scope
Not disclose, tamper with, or destroy personal information
Conduct regular security audits

7.4 数据泄露应急响应

7.4 Data Breach Emergency Response

预防措施: 我们采取多重安全措施降低数据泄露风险。

Preventive Measures: We adopt multiple security measures to reduce data breach risks.

应急响应: 如不幸发生个人信息泄露、篡改、丢失等安全事件，我们将：

Emergency Response: In the unfortunate event of a security incident such as personal information disclosure, tampering, or loss, we will:

立即启动应急预案，采取补救措施防止损害扩大
及时通知您（按照法律要求，在发现后72小时内）：
- 安全事件的基本情况和可能影响
- 我们已采取或将要采取的处置措施
- 您可以自主防范和降低风险的建议
- 对您的补救措施
- 我们的联系方式
通知方式: 邮件、短信、推送通知、应用内公告等
监管报告: 按规定向有关主管部门报告（72小时内）

Immediately activate emergency plan, take remedial measures to prevent damage expansion
Notify you promptly (within 72 hours of discovery, as required by law):
- Basic situation and possible impact of the security incident
- Disposal measures we have taken or will take
- Suggestions for how you can independently prevent and reduce risks
- Remedial measures for you
- Our contact information
Notification Methods: Email, SMS, push notifications, in-app announcements, etc.
Regulatory Reporting: Report to relevant supervisory authorities as required (within 72 hours)

安全事件联系:

Security Incident Contact:

紧急邮箱: security@laiye.ai
客服电话: 010-69265277（24小时）

Emergency email: security@laiye.ai
Customer service phone: 010-69265277 (24 hours)

7.5 安全认证

7.5 Security Certifications

我们正在或已经通过以下安全认证（持续更新中）：

We are in the process of or have obtained the following security certifications (continuously updated):

信息安全管理体系认证（ISO/IEC 27001）（规划中）
网络安全等级保护认证（规划中）

Information Security Management System Certification (ISO/IEC 27001) (In planning)
Cybersecurity Level Protection Certification (In planning)

八、未成年人保护

8. Protection of Minors

8.1 年龄限制

8.1 Age Restrictions

本应用主要面向18周岁及以上的成年用户。

This application is primarily intended for adult users aged 18 and above.

如果您是未满18周岁的未成年人，请在您的父母或监护人的陪同下阅读本政策，并在取得您的父母或监护人的同意后使用本应用或向我们提供信息。

If you are a minor under 18 years of age, please read this policy in the presence of your parents or guardians, and use this application or provide information to us only after obtaining consent from your parents or guardians.

8.2 未满14周岁儿童

8.2 Children Under 14 Years of Age

我们不会主动收集未满14周岁儿童的个人信息。

We do not actively collect personal information from children under 14 years of age.

如果我们发现在未事先获得可证实的监护人同意的情况下收集了未满14周岁儿童的个人信息，我们会尽快删除相关数据。

If we discover that we have collected personal information from children under 14 years of age without prior verifiable parental consent, we will delete the relevant data as soon as possible.

8.3 监护人须知

8.3 Notice to Guardians

如果您是监护人：

If you are a guardian:

请指导和监督您的被监护人使用本应用
如果您发现您的被监护人在未经您同意的情况下向我们提供了个人信息，请联系我们（support@laiye.ai），我们将及时删除

Please guide and supervise your ward's use of this application
If you discover that your ward has provided personal information to us without your consent, please contact us (support@laiye.ai), and we will delete it promptly

特别提示: 如需处理14周岁以下儿童个人信息，我们将专门制定《儿童隐私政策》并取得监护人的单独同意。

Special Notice: If it is necessary to process personal information of children under 14 years of age, we will specifically formulate a "Children's Privacy Policy" and obtain separate consent from guardians.

九、争议解决与投诉

9. Dispute Resolution and Complaints

9.1 投诉渠道

9.1 Complaint Channels

如您认为我们的个人信息处理行为损害了您的合法权益，您可以通过以下方式投诉：

If you believe that our personal information processing activities have harmed your legitimate rights and interests, you can file a complaint through the following methods:

联系方式:

Contact Information:

隐私专用邮箱: support@laiye.ai
客服电话: 010-69265277（工作日 9:00-18:00）
书面信函: 北京市北京经济技术开发区荣华南路2号院2号楼5层514-5室，邮编100000
收件人: 个人信息保护负责人

Privacy dedicated email: support@laiye.ai
Customer service phone: 010-69265277 (Weekdays 9:00-18:00)
Written correspondence: Room 514-5, 5th Floor, Building 2, Courtyard 2, Ronghua South Road, Beijing Economic and Technological Development Area, Beijing, Postal Code 100000
Recipient: Personal Information Protection Officer

响应时间: 我们将在收到投诉后15个工作日内予以答复。

Response Time: We will respond to complaints within 15 business days of receipt.

9.2 监管机构投诉

9.2 Complaints to Regulatory Authorities

如果您对我们的答复不满意，您有权向以下监管机构投诉或举报：

If you are not satisfied with our response, you have the right to file a complaint or report to the following regulatory authorities:

中国大陆用户:

Mainland China Users:

国家互联网信息办公室（国家网信办）
网站: http://www.cac.gov.cn
投诉邮箱: jubao@12377.cn
各省级网信办（按您的居住地）

Cyberspace Administration of China (CAC)
Website: http://www.cac.gov.cn
Complaint email: jubao@12377.cn
Provincial cyberspace administration offices (according to your place of residence)

欧盟用户（如适用）:

EU Users (if applicable):

相关成员国数据保护机构
查询地址: https://edpb.europa.eu/about-edpb/board/members_en

Relevant member state data protection authorities
Inquiry address: https://edpb.europa.eu/about-edpb/board/members_en

9.3 司法救济

9.3 Judicial Remedies

您也可以依法向我们所在地有管辖权的人民法院提起诉讼。

You may also file a lawsuit with the people's court having jurisdiction at our location in accordance with the law.

管辖法院: 北京市大兴区人民法院（我方注册地法院）

Jurisdiction Court: Daxing District People's Court of Beijing (court at our place of registration)

十、隐私政策的更新

10. Updates to Privacy Policy

10.1 更新频率

10.1 Update Frequency

我们可能会适时修订本隐私政策，以反映：

We may revise this Privacy Policy from time to time to reflect:

我们服务的变化
法律法规的变化
数据保护最佳实践的发展

Changes to our services
Changes in laws and regulations
Developments in data protection best practices

10.2 更新通知

10.2 Update Notifications

一般更新:

General Updates:

我们会在本页面发布更新版本
在页面顶部标注"最后更新日期"
建议您定期查看

We will publish the updated version on this page
Indicate "Last Updated Date" at the top of the page
We recommend you check regularly

重大变更通知: 对于重大变更，我们会通过以下一种或多种方式通知您：

Material Change Notifications: For material changes, we will notify you through one or more of the following methods:

应用内弹窗提示
向您的注册邮箱发送邮件通知
在应用首页显著位置公告
推送通知

In-app pop-up notifications
Send email notifications to your registered email address
Prominent announcements on the application homepage
Push notifications

10.3 重大变更定义

10.3 Definition of Material Changes

以下情况视为重大变更：

The following circumstances are considered material changes:

服务模式发生重大变化（如从免费转为收费）
个人信息处理目的、类型、使用方式发生重大变化
个人信息共享、转让或公开披露的对象类别发生变化
您参与个人信息处理方面的权利及其行使方式发生重大变化
个人信息安全影响评估报告表明存在高风险
个人信息保护负责人联系方式变更

Significant changes in service model (such as from free to paid)
Significant changes in the purpose, type, or method of personal information processing
Changes in the categories of parties with whom personal information is shared, transferred, or publicly disclosed
Significant changes in your rights and how to exercise them regarding personal information processing
Personal information security impact assessment reports indicate high risks
Changes in contact information of the personal information protection officer

10.4 您的选择

10.4 Your Choices

重大变更时的选择权:

Right to Choose During Material Changes:

如您不同意更新后的隐私政策，您有权停止使用本应用
如您继续使用，即视为您接受更新后的隐私政策

If you do not agree with the updated Privacy Policy, you have the right to stop using this application
If you continue to use it, you are deemed to accept the updated Privacy Policy

查看历史版本: 您可以在应用内或我们的网站查看隐私政策的历史版本。

View Historical Versions: You can view historical versions of the Privacy Policy within the application or on our website.

十一、联系我们

11. Contact Us

如您对本隐私政策有任何疑问、意见或建议，或需要行使您的权利，请通过以下方式联系我们：

If you have any questions, comments, or suggestions regarding this Privacy Policy, or need to exercise your rights, please contact us through the following methods:

个人信息保护专员

Personal Information Protection Officer

职能: 负责处理个人信息保护相关事务

Function: Responsible for handling personal information protection related matters

邮箱: support@laiye.ai
电话: 010-69265277（工作日 9:00-18:00）
地址: 北京市北京经济技术开发区荣华南路2号院2号楼5层514-5室
邮编: 100000

Email: support@laiye.ai
Phone: 010-69265277 (Weekdays 9:00-18:00)
Address: Room 514-5, 5th Floor, Building 2, Courtyard 2, Ronghua South Road, Beijing Economic and Technological Development Area, Beijing
Postal Code: 100000

客户服务（非隐私问题）

Customer Service (Non-Privacy Issues)

职能: 产品使用、技术支持等一般咨询

Function: General inquiries such as product usage, technical support, etc.

邮箱: support@laiye.ai
电话: 010-69265277

Email: support@laiye.ai
Phone: 010-69265277

响应承诺

Response Commitment

我们将在15个工作日内回复您的请求。

We will respond to your request within 15 business days.

感谢您信任并使用 Karma AI Assistant！

Thank you for trusting and using Karma AI Assistant!

我们将持续努力保护您的隐私和数据安全。如有任何疑问，请随时联系我们。

We will continue to work hard to protect your privacy and data security. If you have any questions, please feel free to contact us.

文档编号: PP-2026-001 | 版本: v1.0 | 制定机构: 北京词元云科技有限公司法务部

Document Number: PP-2026-001 | Version: v1.0 | Issuing Authority: Beijing Ciyuanyun Technology Co., Ltd. Legal Department