AllyNext Privacy Policy

Welcome to AllyNext (the "Product" or the "Service"). AllyNext is founded and operated by Catalina, headquartered in Los Angeles, California, United States ("we", "us" or "our"). Related services within mainland China are provided by its subsidiary, Shenzhen Youfazi Intelligent Technology Co., Ltd. This Privacy Policy (the "Policy") applies to the AllyNext products and services provided by the foregoing entities.

Please read and fully understand this Policy before using our products or services. Provisions of particular importance, such as those that exclude or limit liability, will be highlighted in bold. If you do not agree with any part of this Policy, you should immediately stop using our products or services. By starting to use our products or services, you indicate that you have fully understood and agreed to this Policy.

This Policy will help you understand the following:

This English version applies to users outside mainland China. For users in mainland China, the Chinese-language version of this Policy applies, and the Chinese-language version shall prevail in the event of any inconsistency.

1.1 "AllyNext", the "Product" or the "Service"

The AI e-commerce assistant client software and related services developed and operated by us. Users may download and install the software from the official website and run it on their local devices. The Product provides AI conversation, autonomous agent task execution, file generation and editing, data analysis, cloud drive storage, knowledge base and Skill management, multimodal interaction, scheduled tasks, web page generation, browser automation, third-party platform integration, local file processing and other functions. The specific functions shall be those actually provided by the Product.

1.2 Personal Information

Any information, recorded electronically or otherwise, relating to an identified or identifiable natural person, excluding information that has been anonymized.

1.3 Sensitive Personal Information

Personal information that, once leaked or illegally used, may easily cause harm to the personal dignity of a natural person or endanger personal or property safety, including biometric information, religious beliefs, specific identity, medical and health information, financial accounts, whereabouts and movement trajectories, as well as the personal information of minors under the age of fourteen.

1.4 User Content

Any information you actively input, upload, generate or store while using the Product, including but not limited to text, code, files, images, spreadsheets, documents, web links, task descriptions and knowledge base content.

1.5 AI-Generated Content

Any content automatically generated or generated with assistance by the Product based on artificial intelligence models, including but not limited to text, code, charts, analysis results, images, and audio or video content.

We collect and use your personal information in the following scenarios in accordance with the principles of lawfulness, legitimacy, necessity and good faith:

2.1 Account Registration and Login

We provide the Service on the basis of an AllyNext account. To register and create your AllyNext account, you are required to provide your mobile phone number and SMS verification code information; otherwise you will not be able to register an AllyNext account or use our services. You may also voluntarily complete your nickname and avatar. Such information is optional personal information, and your failure to provide it will not affect your use of the basic services.

2.2 Core Business Functions

2.2.1 Intelligent Conversation and Autonomous AI Task Execution

When you converse with the AI or use the Service to carry out various tasks, we collect the text content you input, historical conversation records, task descriptions, instructions, material content, editing instructions, data files and analysis instructions, as well as the intermediate results and generated content produced by the AI during execution. The above information is used to understand your intent, plan execution steps, complete automated operations and generate replies, documents, analysis results and other content.

When you install and run AllyNext on your local device and log in to use the Service, we may synchronize to the cloud the data you generate, upload, save or authorize us to process in the client, in order to enable data synchronization, task continuity, cloud drive storage, knowledge base management, memory features, cross-device access, security risk control and troubleshooting.

When you enable features such as agent task execution, browser automation, local file processing or third-party platform connections, the Product may, within the scope of your authorization, configuration, confirmation or task instructions, access local files, local directories, browser sessions, system environment information, third-party account connection information, API keys, webhooks, OAuth tokens, database connection information and other resources, and may synchronize or transmit the relevant content to the cloud for processing as required by the task.

Please note that because the agent has autonomous execution capabilities, it may produce unexpected results during execution. We recommend that you manually confirm before the agent performs high-risk operations (such as bulk deletion, data modification or sending information externally).

2.2.2 Cloud Drive

When you use the cloud drive function, we collect the files you upload and their metadata (file name, size, type, upload time, etc.) for the storage, management and retrieval of such files.

2.2.3 Knowledge Base and Skill Plugins ("Skills")

When you use the knowledge base function, we collect the knowledge content, documents, web links and other materials you add, in order to build a dedicated knowledge base that enhances the AI's answering capabilities.

When you install or use Skill plugins, we collect the configuration information and runtime data of such Skill plugins in order to load and execute the corresponding Skills.

2.2.4 Scheduled Tasks

When you set scheduled tasks, we collect the task content, execution time, trigger conditions and other information you configure, in order to execute tasks automatically according to schedule.

2.2.5 Web Page Generation

When you use the web page generation function to generate a website or page, we collect the page content and configuration information you provide and the published page data, in order to generate, host and serve the page. Pages you publish may contain personal information that you have voluntarily made public; please act with caution.

2.2.6 Memory Feature

To provide you with a coherent service experience, we offer a memory feature. Once enabled, this feature collects the preferences, historical instructions, task context and feedback you provide in conversations, as well as derived data such as summaries generated during the service. Such data is used only to support contextual understanding, customized responses and task continuity, and is not used for user profiling or shared with third parties. You may disable the memory feature at any time; upon disabling, we will stop collecting new memory data and will delete stored information within a reasonable period. Disabling the feature does not affect your use of the basic functions.

2.2.7 IM Channels

To enable you to receive and reply to messages through third-party IM platforms such as DingTalk, WeChat and Feishu, the IM channel function reads the channel connection information you configure (such as bot webhook addresses and gateway parameters). When you send or receive content through IM channels, the relevant message data is used only to ensure the normal operation of the Service; we will not use such messages for any purpose other than this function. You may delete configured IM channels at any time.

2.2.8 Experience Optimization Program

We provide an Experience Optimization Program in the client under "Privacy – Experience Optimization Program", which is enabled by default. Enabling the Experience Optimization Program indicates that you permit us to obtain your conversation data for the purposes of problem analysis and product optimization. You may disable this program at any time in the client under "Privacy – Experience Optimization Program"; upon disabling, we will stop collecting such data, and this will not affect your use of other functions of the Product.

2.3 Device Information and Logs

To ensure the secure and stable operation of the Service, troubleshoot issues and optimize the experience, we collect the following information:

• Device information: device model, operating system version, browser type and version, screen resolution, language settings;
• Log information: IP address, access time, operation records, error logs, performance data;
• Location information: coarse geographic location inferred from your IP address. We do not collect precise location information;
• Usage behavior information: feature usage frequency, session duration, interaction paths, etc., used for product experience analysis.

2.4 Marketing Communications

We may send you marketing information such as feature updates, product introductions and promotional activities through in-app messages, emails, SMS or telephone calls. You may unsubscribe at any time using the opt-out method provided in such communications. Even if you unsubscribe from marketing communications, we will continue to send you necessary service-related notices (such as account security alerts, order confirmations and policy changes).

2.5 Customer Service and Feedback

When you contact us for assistance or submit feedback, we collect the contact information, problem description, screenshots and other related materials you provide, in order to respond to your request and improve our services.

2.6 Other Purposes

To the extent permitted by laws and regulations, we may use the information collected for the following purposes:

• Security: identity verification, anomaly detection, anti-fraud and risk control;
• Compliance: performing obligations prescribed by laws and regulations and cooperating with regulatory investigations;
• Statistical analysis: conducting internal statistics and research after de-identification;
• Other reasonable purposes for which you have given consent.

If we use your information for purposes not specified in this Policy, or use information collected for a specific purpose for another purpose, we will obtain your explicit consent in advance.

3.1 Cookies

Cookies and other similar technologies are commonly used on the Internet. When you use our services, we store cookies on your device in order to ensure the normal operation of the Product and improve the user experience. During the operation of the client, we may also use local caches, local configuration files or similar technologies to store login status, feature configuration, task status, error logs and preference settings. The cookies we use fall into the following categories:

• Strictly necessary cookies: required for basic functions such as maintaining login status and security authentication; these cannot be disabled;
• Functional cookies: remember your preferences (such as language and theme) to enhance your experience;
• Analytics cookies: help us understand product usage and performance for optimization purposes.

We do not use advertising cookies.

3.2 Device Fingerprinting

We use device fingerprinting technology only in security risk control scenarios, to identify anomalous logins and prevent fraudulent activity. It is not used for user profiling or advertising tracking.

3.3 Managing Cookies

Most browsers support managing or deleting cookies. You may refuse or clear cookies through your browser settings, although this may affect the normal operation of some functions.

4.1 Entrusted Processing

We may entrust affiliates, suppliers and partners ("entrusted parties") with the processing of your personal information so that they may provide certain services or perform functions on our behalf. We will entrust such processing only for the lawful, legitimate, necessary, specific and explicit purposes stated in this Policy. Entrusted parties will have access only to the information necessary to perform their duties, and we will require by contract that they not use such information for any purpose beyond the scope of the entrustment. If an entrusted party uses your information for purposes we have not entrusted, it will separately obtain your consent. Currently, the categories of entrusted parties we engage include:

Technology infrastructure and model service providers: To provide the Service and ensure its stable operation, we entrust cloud service providers and foundation model service providers with the processing of part of your personal information. Such entrusted parties process information only to the extent necessary to provide technical infrastructure, computing resources or model capabilities, and will not use the information for model training or any other purpose beyond the scope of the entrustment.

Sales and service support partners: We may entrust sales and service support partners with the processing of necessary information in order to provide pre-sales consulting, in-sales support and after-sales service based on your needs.

Payment service providers: To complete order payments, we provide third-party payment service providers with your account information, order information, payment account information and other information necessary to complete the payment.

4.2 Sharing

Except in the following circumstances, we will not share your personal information with any third party:

• With your explicit consent;
• As required by laws and regulations, legal process or mandatory requirements of competent government authorities;
• With authorized partners, solely to achieve the purposes described in this Policy and subject to strict data protection agreements.

4.3 Transfer

We will not transfer your personal information to any third party except:

• With your explicit consent;
• As required by laws and regulations;
• In connection with a merger, acquisition, asset transfer or similar transaction involving the transfer of personal information, in which case we will require the new holder to remain bound by this Policy, failing which we will seek your consent again.

4.4 Public Disclosure

We will publicly disclose your personal information only in the following circumstances:

• With your explicit consent;
• As required by laws and regulations, legal process or mandatory requirements of competent government authorities.

We will not publicly disclose your personal information for commercial purposes.

5.1 Storage Location

The cloud data involved in the Service is stored on servers located in Los Angeles, California, United States. To support account login, cross-device use, cloud drive storage, task records, knowledge bases, the memory feature, data synchronization, service security and troubleshooting, we may synchronize to the cloud the relevant data you generate, upload, save or authorize us to process in the local client.

Some caches, configuration files, logs or temporary data generated during the operation of the local client may also be stored on your local device. You may manage or delete data stored on your local device yourself through client functions or your operating system.

If you access or use the Service from a region outside the United States, your personal information will be transferred to and processed in the United States. Where required by applicable law, we will obtain your separate consent, implement appropriate safeguards for the cross-border transfer (such as standard contractual clauses), conduct any required transfer impact assessment or security assessment, and take other measures necessary to ensure that your personal information receives an adequate level of protection.

5.2 Retention Period

We retain your personal information only for the shortest period necessary to achieve the purposes described in this Policy, unless otherwise provided by laws and regulations or required by regulatory authorities.

In determining the retention period of personal information, we generally consider the longer of the following:

(1) the period required to complete the service purposes related to you; (2) the period required to maintain transaction records, handle complaints, resolve disputes, prevent risks and ensure security; (3) mandatory retention periods prescribed by laws and regulations; (4) the period required for auditing, regulatory review, litigation evidence and compliance management.

After the retention period expires, we will delete or anonymize your personal information; however, due to technical constraints, backup replacement cycles or legal obligations, the relevant information may not be deleted from backup systems immediately, and during that period we will take necessary measures to restrict its processing.

5.3 Security Measures

We take measures including but not limited to the following to protect the security of your personal information:

• Technical measures: encrypted transmission (TLS/SSL), encrypted data storage, access control, security auditing and other technical means to prevent data leakage, tampering and loss;
• Organizational measures: establishing and improving data security management systems, applying the principle of least privilege, and conducting regular security training and risk assessments;
• Physical measures: strict physical security safeguards, including access control systems, surveillance systems and environmental controls;
• Incident response: data security incident response plans, under which we will promptly notify you and take remedial measures in the event of a security incident.

5.4 Security Incident Response

If a personal information security incident occurs, we will notify you in a timely manner as required by laws and regulations of: the basic situation and possible impact of the incident, the measures we have taken or will take, suggestions for you to independently prevent and mitigate risks, and remedial measures available to you. We will notify you through in-app messages, emails, SMS or other means, and where it is difficult to notify you individually, we will issue a public announcement through reasonable and effective means. We will also report the handling of the security incident to regulatory authorities as required.

You have the following rights with respect to your personal information under applicable data protection laws, including where applicable the Personal Information Protection Law of the People's Republic of China:

6.1 Right of Access

You may access your profile, conversation records, cloud drive files and other information through the account settings page in the Product.

6.2 Right of Correction

If you find that the personal information we process about you is inaccurate, you may correct it yourself through the account settings page, or contact us for correction using the contact details described in Section 9 of this Policy.

6.3 Right of Deletion

You may request that we delete your personal information in the following circumstances:

• The processing purpose has been achieved, cannot be achieved, or is no longer necessary for the processing purpose;
• We cease providing the product or service, or the retention period has expired;
• You withdraw your consent;
• We processed personal information in violation of laws, administrative regulations or our agreement with you;
• Other circumstances provided by laws and administrative regulations.

You may delete conversation records, files and other content yourself through the deletion functions in the Product, or delete or anonymize the cloud personal information associated with your account by deleting your account.

6.4 Right to Withdraw Consent

For personal information processing activities based on consent, you may withdraw your consent at any time through the relevant toggle in the Product. Withdrawal of consent does not affect the validity of personal information processing activities carried out on the basis of consent before the withdrawal.

6.5 Right to Delete Your Account

After your account is deleted, we will delete or anonymize the cloud personal information associated with your account as required by applicable law. For data that has been synchronized to the cloud, the deletion rules are subject to this Policy and the actual functions in the Product; for data still stored on your local device, you may delete it yourself through client functions or your operating system.

Please note: account deletion is irreversible, and cloud data associated with your account may not be recoverable after deletion. For data on your local device, please back it up or delete it yourself before deleting your account or uninstalling the Product.

6.6 Right to Obtain a Copy of Your Personal Information

You have the right to request a copy of your personal information. Please submit your request to us using the contact details described in Section 9 of this Policy, and we will provide it to you within fifteen business days after verifying your identity.

6.7 Right to Explanation

You have the right to request an explanation of our personal information processing rules. Please contact us using the contact details described in Section 9 of this Policy.

6.8 Right to Complain

If you believe that our personal information processing activities have infringed your lawful rights and interests, you may send an email to support@allynext.ai to lodge a complaint, or lodge a complaint with the competent regulatory authority.

The Product is primarily intended for adult users. We do not knowingly collect the personal information of minors under the age of fourteen.

If you are a minor aged fourteen or older but under eighteen, please read this Policy together with your guardian and use the Product only after obtaining your guardian's consent. Guardians should perform their duties of guardianship over minors and guide minors to use the Product safely and reasonably.

If we discover that we have collected the personal information of a minor under the age of fourteen without the consent of the guardian, we will delete the relevant data as soon as possible.

If you are the guardian of a minor and have questions about the personal information of the minor under your guardianship, please contact us using the contact details described in Section 9 of this Policy.

We may revise this Policy from time to time. When changes are made, we will notify you in the following ways:

• Prompting you to review the updated Policy through pop-up windows, announcements or other means in the Product;
• For material changes, seeking your consent again.

Material changes include but are not limited to:

• Changes in the name or contact details of the personal information processor;
• Changes in the purposes, methods or categories of personal information processed;
• Changes in the manner and procedures for individuals to exercise their rights;
• Changes in the scope or method of providing personal information overseas;
• Other matters that may materially affect your rights and interests.

If you continue to use the Product after this Policy is updated, you indicate your acceptance of the updated Policy.

If you have any questions, comments or suggestions about this Policy or our personal information processing activities, please contact us as follows:

• Email: support@allynext.ai
• Personal Information Protection Officer: reachable via the email address above

We will respond within fifteen business days after receiving your request. If we cannot complete the response within that period for reasonable reasons, we will explain the situation to you and appropriately extend the response period.

9.1 Governing Law and Dispute Resolution

This Policy and any dispute or claim arising out of or in connection with it, including its formation, interpretation, breach or termination, shall be governed by and construed in accordance with the laws of the State of California, United States, without regard to its conflict-of-laws principles.

If you are dissatisfied with our response — in particular, if you believe that our personal information processing activities have harmed your lawful rights and interests — you may bring a lawsuit before the state or federal courts located in Los Angeles County, California, which shall have exclusive jurisdiction, or lodge a complaint with the competent regulatory authority. Nothing in this section limits any mandatory rights you may have under the laws of your place of residence.