Cherry on Art Platform (operating entity: Inno Tech (Shanghai) Ltd.)

Part I: Introduction

Welcome to the Cherry on Art platform!

We highly value the privacy and personal information of our users. Through the Cherry on Art Privacy Policy (“this Privacy Policy”), we aim to explain how we collect, use, store, share, and transfer your information when you use our products and/or services, as well as how we provide you with the ability to access, update, delete, and protect such information. Please read this Privacy Policy carefully and fully understand its provisions, especially those highlighted in bold or bold underlined text, so that you can make informed choices when using our products and/or services in accordance with this Privacy Policy.

You warrant that you possess the civil capacity required under the laws of the People’s Republic of China to engage in the actions described herein. If you are under 18 years of age or otherwise lack the civil capacity required for your actions, please read and determine whether to agree to this Policy under the guidance of your legal guardian (hereinafter referred to as the “Guardian”), and pay special attention to the provisions regarding the protection of minors’ personal information.

This Privacy Policy applies to the Cherry on Art platform, including the Cherry on Art website (www.cherryonart.com), the WeChat Mini Program (Cherry on Art), and related products and/or services provided through new client forms that may emerge with technological developments.

If a particular product and/or service has a separate privacy policy or special provisions in its user service agreement, such provisions shall take precedence. For matters not covered therein, this Privacy Policy shall apply. If you do not agree to this Privacy Policy (including future updates), it may result in the products or services not functioning properly or not achieving the expected outcomes. In such a case, you should immediately stop accessing or using our products and/or services.

1. Personal Information and Sensitive Personal Information

1.1 Personal Information refers to any information recorded electronically or by other means that can, either alone or in combination with other data, identify a specific individual or reflect their activities. The Personal Information covered in this Privacy Policy includes but is not limited to:

(1) Basic information: name, nickname, date of birth, age, gender, residential address, photo, avatar.

(2) Personal Identification Documents: ID card, passport etc.

(3) Communication Information: address book/contacts.

(4) Online identity information: account, username, IP address, Cookie/Session identifiers, device identifiers (such as IMEI, Android ID, IDFA).

(5) Transaction and Financial Information: transaction records, order details, payment accounts (Alipay, WeChat Pay, PayPal, etc.), Cherry on Art artist commission balance, coupons.

(6) Contact Information: mobile phone number, email address, mailing/residential address.

(7) Internet and Usage Records: website browsing history, software usage history, click records, search history, operation logs, favorites, shopping cart, wishlist.

(8) Device Information: hardware model, device MAC address, operating system, software version, screen resolution, language settings.

(9) Location Information: approximate location (derived from IP, base station, Wi-Fi information), precise geolocation (latitude and longitude).

(10) Network Information: Wi-Fi details, base station information, DNS address, DHCP address, SSID, BSSID.

1.2 Sensitive Personal Information refers to data which, if leaked, illegally provided, or misused, may endanger personal or property security, damage an individual’s reputation, physical or mental health, or lead to discriminatory treatment. The Sensitive Personal Information covered in this Privacy Policy includes:

(1) Transaction and Financial Information: transaction records, order details, payment accounts (Alipay, WeChat Pay, PayPal, etc.), Cherry on Art artist commission balance, coupons.

(2) Personal Identification Documents: ID card, passport etc.

(3) Other information: contacts, mobile phone number, web browsing history, geolocation.

Part II: Privacy Policy for Users within China

1. How We Collect and Use Your Personal Information

1.1 To provide online shopping services, we collect the Personal Information necessary for the following functions: account registration and login, product/service display, order placement and management, payment, logistics and delivery, customer service and after-sales support, and transaction security. Without such information, the corresponding functions may not operate properly.

(1) Account Registration and Login

When registering for a Cherry on Art account, you must provide your email address and password. We will verify your email through a verification code to ensure that you control the email account, thereby providing secure login services.

If you log in via WeChat authorization, you may be required to provide your email address when using the web platform. Refusal to provide may limit functionality.

Your account name will serve as your default nickname. You may optionally provide or update profile information (nickname, gender, date of birth) for personalized services. Such information is not mandatory.

(2) Product/Service Information Display

To display products and services, we collect device information (device model, OAID/IDFA, IDFV, operating system and app version, language settings, resolution) and browser type. This allows us to optimize content and compatibility with your device.

To provide search, wishlist, shopping bag, and order display services, we collect browsing history, search history, favorites, shopping cart data, and order information.

(3) Order Placement and Management

When placing an order, you must provide the recipient’s name, shipping address, and mobile phone number. The order will include order number, product/service details, order time, payable amount, and payment method.

This information constitutes your “Order Information.” We use Order Information (including with third-party partners) to verify identity, confirm transactions, process payments, fulfill delivery, track orders, and provide customer service. We may also use it to detect abnormal transactions and ensure transaction security.

(4) Payment

You may complete payments through partnered third-party payment institutions (e.g., Alipay, WeChat Pay). We will share your Order Information with these institutions as necessary to process payments.We may collect your third-party payment account details but will not collect your bank card information directly. Payment institutions may, through their own platforms, collect or verify your bank card details to complete payment, subject to their respective privacy policies.

To confirm payment status, we collect payment-related details from these institutions, including payment time, method, and amount.

(5) Product/Service Delivery

After successful payment, Cherry on Art or partnered logistics providers will deliver your order. For delivery purposes, your Order Information will be used to ensure that your purchased goods are safely delivered.

(6) Customer Service and After-Sales Support

If you encounter order-related issues, our customer service team will use your account and order information to assist you. To verify your identity, we may compare provided information against previously collected data. Once verified, we may collect your communication records, contact details to resolve issues and improve our services.

If you require an invoice, you must provide the invoice title, taxpayer identification number, and recipient email address. We will issue the invoice based on the details you provide.

1.2 To enable browsing, liking, and bookmarking functions, the Cherry on Art Platform will collect the accounts you follow and related activity information, and display the content published by these accounts. If you refuse to grant authorization, you will not be able to use these functions; however, this will not affect your use of other features.

1.3 As an artist, you must first register as a user of this platform before applying for artist status. To enable the artwork upload feature, we will request your authorization to read external storage and access files and data (such as documents, images, etc.) stored on your device’s external storage, based on the content you upload. You may create a personal homepage and showcase your artworks.

1.4 To ensure transaction security, enhance system safety while you use the Cherry on Art Platform, effectively prevent phishing fraud, and protect your account, we collect and analyze the following information:

(1) Operational information: including browsing records, order details.

(2) Device information: such as device MAC address, operating system type, unique device identifiers (IMEI/Android ID/IDFA/OpenUDID/GUID), etc.

(3) Risk information: records of potentially risky links (URLs) and IP addresses.

We use this information to assess account risks, analyze platform issues, generate traffic statistics, and detect potential risks. If you choose to send us abnormal information, we will further investigate based on the information provided.

1.5 To fulfill legal or regulatory obligations, when you use certain services (e.g., artist application, artist commission settlement), if required by laws, regulations, or supervisory authorities to verify your real identity, you will need to authorize us to collect and process your relevant information in accordance with the law. In such cases, with your separate consent, you must provide us with valid identification documents as required by laws and regulations. You also authorize us to convert such identification document information into textual personal information (including name, gender, document type, document number, etc.) and to store or report it to competent authorities in compliance with applicable laws and regulations.

1.6 To make your consumption and information access more convenient and to enhance your service experience on the Cherry on Art Platform, we may collect and use your Personal Information in the following additional features. If you do not provide this information, you can still conduct online transactions and access information normally, but you may not enjoy the convenience or benefits of these features, and you may need to re-enter certain information when purchasing specific products/services. These features include:

(1) Personalized recommendation: To recommend products or services that better match your interests, we will collect your order information and browsing history and analyze the data to create a user profile. This allows us to display products or services that may interest you or show relevant items during searches. We may associate information collected across your devices to provide consistent services. We may also combine data from one service with information from other services to improve personalization.

(2) Camera-based features: You may use your device’s camera to take photos for after-sales service requests.

(3) Device information-based features: To provide better products/services and improve user experience, we collect device attribute information (including hardware model, OS version, device configuration, unique device identifiers, IMEI, MAC address, advertising identifier IDFA) and device connection information (including browser type, telecom carrier, language in use). This information is used for risk control, transaction security, and troubleshooting. We may associate information collected across your devices to provide consistent services. We may also link your device information or phone number to your account to ensure the security and protection of your account and rights.

Enabling the above functions means you authorize the Cherry on Art Platform to collect and use your Personal Information for such purposes. Conversely, disabling the permissions means you withdraw your authorization, and the Cherry on Art Platform will no longer collect or use the relevant Personal Information and will be unable to provide you with the associated features.

1.7 You understand and acknowledge that under the following circumstances, we may collect and use your Personal Information without obtaining your prior authorization or consent:

(1) Compliance with legal obligations: where necessary to comply with applicable laws and regulations.

(2) National security and defense: where directly related to national security or defense.

(3) Public safety and interest: where directly related to public safety, public health, or significant public interests.

(4) Judicial and law enforcement: where directly related to criminal investigation, prosecution, trial, or enforcement of judgments.

(5) Vital interests: where necessary to protect your or another individual’s life, property, or other significant lawful rights and interests, and it is difficult to obtain your consent.

(6) Information disclosed by you: where the Personal Information is made publicly available by yourself.

(7) Contract performance: where necessary to sign and perform a contract at your request.

(8) Legitimate public sources: where Personal Information is collected from lawful public disclosures, such as legitimate news reports or government information disclosure channels.

(9) Product/service maintenance: where necessary to maintain the safe and stable operation of our products and/or services, including discovering and resolving technical issues.

2. Use of Cookies

2.1 When you use our services, we may place one or more small data files called “Cookies” on your computer or mobile device. These files typically contain identifiers, site names, and certain numbers or characters. Cookies are used to simplify repeated login steps, store your shopping preferences or shopping cart data, provide personalized settings, verify your login status, and help ensure account and data security. We do not use Cookies for any purposes other than those set out in this Privacy Policy.

2.2 You may manage or delete Cookies according to your preferences. Most web browsers automatically accept Cookies, but you can usually modify your browser settings to block them. You may also manually delete all Cookies stored on your device. Please note that if you block or delete Cookies, you may need to reconfigure your settings each time you visit the Cherry on Art platform, previously stored information will be removed, and this may affect the security of the services you use.

3. How We Share Your Personal Information

3.1 We do not share your personal information with any company, organization, or individual outside of the Cherry on Art, except in the following circumstances:

(1) With your prior explicit consent or authorization.

(2) As required by applicable laws, regulations, or mandatory requests by administrative or judicial authorities.

(3) At your request to resolve disputes or conflicts with others.

(4) As necessary to perform agreements signed with you (including electronic agreements and platform rules) or other legal documents.

(5) For reasons of public interest permitted by law, such as public health emergencies.

3.2 To provide products or services and to protect your account and transaction security, we may share your personal information with our affiliates or trusted partners. The information shared will be limited to what is necessary for the service to be delivered (e.g., order details, account information, device information, location information) and will remain subject to the purposes described in this Privacy Policy. Please be aware that any information you voluntarily choose to share or publicly disclose while using our services may include your personal information, third-party information, or even sensitive personal information. Please consider carefully before sharing, and if third-party information is involved, ensure you have obtained lawful authorization.

3.3 Categories of our partners include:

(1) Suppliers of goods or technical services: To deliver core functions of our products/services, we may share your personal information with third-party suppliers, infrastructure and technology providers, logistics providers, payment processors, and data processors.

(2) Other business partners: For partners who entrust us with promotion or advertising, we may share aggregated, anonymized information to improve advertising effectiveness and understand user needs. We will not share personally identifiable information without your consent.

3.4 Specific cases of sharing with third-party partners include:

(1) Alipay SDK

Purpose: Payment processing via Alipay

Scenario: Alipay payments

Information shared: Device identifiers (IDFV, OAID, IMEI, MEID, IMSI, Android ID), MAC address, OS version, device brand/model/configuration, carrier type, app information (name, version)

Method: SDK is initialized within the app and operates under its own logic

Website: https://open.alipay.com/platform/home.htm

Company: Alipay (Hangzhou) Information Technology Co., Ltd.

(2) WeChat SDK

Purpose: Login, sharing, and payment functions via WeChat

Scenario: WeChat login, content sharing, and WeChat payments

Information shared: Device identifiers (IDFV, OAID, IMEI, MEID, IMSI, Android ID), MAC address, OS version, device brand/model/configuration, carrier type, app information (name, version)

Method: SDK is initialized within the app and operates under its own logic

Website: https://open.weixin.qq.com/

Company: Shenzhen Tencent Computer Systems Co., Ltd.

(3) SF Express SDK

Purpose：To enable order tracking, shipment status updates, and courier pick-up services

Scenario：Used during logistics fulfillment, shipment tracking, or courier pick-up requests after an order is placed

Shared Information：Recipient and sender details (name, contact information, address), order details (order ID, product information), device identifiers (IDFV, OAID, IMEI, MEID, IMSI, Android ID), OS version, device brand/model, carrier type, application information (app name, version)

Sharing Method：SDK is initialized within the app and communicates with SF Express servers under its own logic

Website：https://open.sf-express.com/

Company：SF Express Co., Ltd

3.5 We may publicly disclose your personal information only under the following circumstances, and only after taking industry-standard security measures:

(1) With your separate consent for disclosure within a defined scope.

(2) If you violate applicable laws or regulations, or seriously violate Cherry on Art platform agreements or rules, we may disclose information about your violation and the measures taken against you.

4. How We Protect and Store Your Personal Information

4.1 We place great importance on the security of your personal information and adopt industry-standard safeguards, including organizational measures and security technologies, to prevent unauthorized access, use, modification, or loss of data. Specific measures include:

(1) Data transmission security: All data transferred between your browser and our servers is encrypted using SSL/TLS protocols. We provide services via HTTPS to prevent man-in-the-middle attacks and data breaches.

(2) Data storage security: Personal information is encrypted using advanced algorithms (e.g., AES-256) when stored, with logical and physical separation from other data to minimize risk.

(3) Data usage security: Personal information is desensitized through techniques such as masking and hashing. We follow the principle of minimum necessity, retaining data only for the shortest period required, and deleting or anonymizing it once the purpose has been achieved.

(4) Access control & authentication: Role-Based Access Control (RBAC) ensures only authorized personnel can access relevant data, with dynamic permission adjustments based on job responsibilities.

(5) Employee training: We provide regular training on data security, privacy protection, and compliance with the "Personal Information Protection Law of the People’s Republic of China".

(6) Incident response: In the event of a personal information security incident, we will take immediate measures to mitigate the risks. At the same time, in accordance with applicable laws and regulations, we will promptly notify you via email, phone call, push notification, or other means of: the basic facts of the incident and its potential impact, the measures we have taken or plan to take, recommendations for how you may independently prevent or reduce risks, and the remedies available to you. If it is difficult to notify individuals one by one, we will issue a reasonable and effective public announcement. In addition, we will proactively report the handling of such incidents to the regulatory authorities as required.

4.2 Personal information is stored within the territory of the People’s Republic of China. If cross-border transfer is required, we will strictly comply with applicable laws and ensure the recipient provides equivalent levels of protection.

4.3 During your use of our products and/or services, your personal information will be retained for the period necessary to fulfill the purposes described in this Policy, and in accordance with mandatory retention periods required by law. For example, under the "E-Commerce Law of the People’s Republic of China", product and service information as well as transaction records must be retained for no less than three years from the date the transaction is completed. Once the applicable retention period has expired, we will delete your personal information or anonymize it in compliance with applicable legal requirements.

4.4 Once you request to delete your Cherry on Art account, we will review your application. Upon approval, we will stop providing products and/or services to you and will delete or anonymize your personal information in accordance with legal requirements.

5. How You Can Manage Your Personal Information

Cherry on Art values your concerns about personal information and makes every effort to protect your rights to access, correct, delete, and withdraw consent regarding your personal data, so that you can fully safeguard your privacy and security. Your rights include:

5.1 Right to know how we process your personal information：You have the right to understand how we process your personal information, including the purposes of collection, methods of processing, storage duration, and sharing recipients. You can obtain detailed information by reading this Privacy Policy or by contacting our customer service.

5.2 Right to access and correct your personal information：Unless otherwise required by laws or regulations, you have the right to access and correct your personal information at any time, including:

(1) Account Information

Website: Go to buyer end - click【My Account - Personal Details】to edit your user name, gender, date of birth, and mobile number, and to view your email address and Cherry on Art User ID.

(2) Shipping Information

Website: Go to buyer end-click【My Account - Address Book】 to add, edit, or delete shipping addresses. You can also set a default address for automatic use in future purchases.

(3) Order Information

Website: Go to buyer end-click【My Account - Orders and Returns】to view all Completed, Awaiting Payment, Awaiting Shipment, Dispatched, Canceled, or Returned/Refunded orders.

(4) Artist Profile Information

Website: Go to sell end - click【Personal Information】to edit your gender, date of birth, mobile number, and to view your email address, name, nationality, personal bio, and profile photo.

(5) Artist Payment Information

Website: Go to sell end - click【Funds Management】to provide payment account details and view past transaction records.

5.3 Right to delete your personal information: You may delete certain personal information in the ways described under “Access and Correct Your Information” or delete all your personal data by canceling your account. You may request deletion of personal information in the following circumstances:

(1) Our processing of your personal data violates laws or regulations.

(2) We collect or use your personal information without your consent.

(3) Our processing seriously breaches our agreement with you.

(4) We cease providing products and/or services, or the retention period has expired.

If we accept your deletion request, we will also notify third parties who obtained your data from us and request deletion (unless otherwise required by law or they have obtained your independent authorization). Please note, due to legal or technical constraints, data may not be immediately removed from backup systems; however, it will be securely stored and restricted from further processing until deletion or anonymization is possible.

5.4 Right to withdraw consent: You have the right to withdraw your consent to Cherry on Art’s processing of your personal information at any time. Upon withdrawal, we will immediately stop collecting and processing the relevant data. However, withdrawal of consent will not affect prior processing carried out with lawful grounds during the period of consent. You may withdraw by deleting information, contacting customer service, or canceling your account. Please note that we may be unable to accommodate withdrawal requests relating to personal information necessary for providing core functions of Cherry on Art or fulfilling legal obligations.

5.5 Right to cancel your account: You may apply to cancel your account through customer service. After verifying that your account meets the conditions for cancellation (e.g., no pending transactions, unsettled payments, unresolved disputes, or regulatory obligations; no linked artist account; account not frozen), we will process the cancellation within seven (7) business days. Once canceled, we will cease providing products and/or services and will delete or anonymize your personal information, unless otherwise required by law. Please note, due to technical limitations, certain data may not be immediately removed from backup systems; however, it will be securely stored and restricted from further processing until deletion or anonymization is possible.

6. Protection of Minors’ Personal Information

6.1 Our products and/or services are primarily intended for adults. When you access or use our services, we assume that you have the civil capacity required under the laws of the People’s Republic of China. We do not knowingly collect, receive, or retain personal information from individuals under 18 years of age. If a parent or guardian discovers that a minor has provided us with verified personal information, please contact us immediately.

6.2 Cherry on Art attaches great importance to the protection of minors’ personal information. If you are under 18 years of age, please ask your parents or guardians to carefully read this Privacy Policy and obtain their consent before using our products and/or services or providing us with your information. Minors, especially children under 14, should not create their own accounts or use our products and/or services without parental or guardian consent.

6.3 Where minors’ personal information is collected with parental or guardian consent, we will implement the following additional safeguards:

(1) For collected minors’ information, in addition to complying with this Privacy Policy, we will follow the principles of legitimacy, necessity, informed consent, clear purpose, and security. We will only collect the minimum amount of information necessary and will strictly comply with applicable laws and regulations such as the "The Provision on the Cyber Protection of Children's Personal Information". Data will not be retained beyond the period necessary to achieve the stated purposes, after which it will be deleted or anonymized.

(2) Minors and their guardians have the right to access, correct, or delete such information at any time. If you are a guardian and have any concerns, suggestions, complaints, or reports regarding a minor’s personal information, please contact us, and we will provide assistance.

Part III: Privacy Policy for Overseas Users

1. Cross-border Transfer of Personal Information

Cherry on Art is a company registered in China. When you register with Cherry on Art, your personal information will be stored within the territory of the People’s Republic of China in order to provide stable and seamless services.

(1) Items of personal information: As described in Sections 1.1 and 1.2 of Part I

(2) Country/Region: China

(3) Time and method of transfer: Transmitted over the network when you use the services

(4) Recipient: Inno Tech (Shanghai) Ltd. (Hello@cherryonart.com)

(5) Purpose: Cloud server operation and management

(6) Safeguards: We will adopt technical measures such as encryption and access control during cross-border transfers to ensure the security of your personal information

2. Personal Information Protection System

Your personal information will be strictly protected. For specific rules, please refer to Part II 【4. How We Protect and Store Your Personal Information】. We employ measures such as encrypted storage, minimum necessary authorization, regular reviews, deletion, and anonymization to reduce risks.

3. Special Provisions

If you are located in the following regions, all provisions of this Privacy Policy apply to you. At the same time, we will make the following special provisions in accordance with the applicable laws and regulations of your jurisdiction. In the event of any inconsistency between these special provisions and Part II of this Privacy Policy, the special provisions shall prevail.

3.1 Europe

(1) We process your personal information in accordance with the “EU General Data Protection Regulation (GDPR)”.

(2) You expressly consent to the storage of your personal information on servers located in China operated by Cherry on Art.

(3) If your personal information needs to be provided to third parties (whether inside or outside of China), we will obtain your separate consent before doing so.

(4) We process personal information only within the necessary scope and on lawful bases (such as performance of a contract, legitimate interests, legal obligations, or your consent).

(5) You have the right to exercise data subject rights under GDPR, including the rights of access, rectification, erasure, restriction of processing, data portability, and objection.

(6) As our processing of your personal information is occasional and low-risk, we have not appointed an EU representative. If you have any questions, comments, or concerns regarding this Privacy Policy or your personal information, you may contact us at Hello@cherryonart.com or via online customer service.

3.2 Japan

(1) We process your personal information in accordance with the Act on the Protection of Personal Information (APPI).

(2) You expressly consent to the storage of your personal information on servers located in China operated by Cherry on Art.

(3) Individuals aged 15 or under are generally regarded as children. We do not knowingly collect information from children, and if we inadvertently do so, we will promptly delete such information.

(4) If your personal information needs to be provided to third parties (whether inside or outside of China), we will obtain your separate consent before doing so.

(5) You have the right to request notification, disclosure, correction, suspension of use, or deletion of your personal information.

(6) If you have any questions, comments, or concerns regarding this Privacy Policy or your personal information, you may contact us at Hello@cherryonart.com or via online customer service.

3.3 Other Countries

(1) If your country or region is not specifically listed above, we will still comply with the general terms of this Privacy Policy and protect your personal information in accordance with applicable laws.

(2) For cross-border transfers, we will adopt reasonable and necessary safeguards (such as encryption, access control, or contractual clauses) to ensure that your personal information is adequately protected.

(3) If you believe that our processing of your personal information does not comply with the laws and regulations of your jurisdiction, you may contact us via Hello@cherryonart.com or through online customer service.

Part IV: Others

1. Updates and Notifications

1.1 To provide better services and as Cherry on Art continues to grow, this Privacy Policy may be updated. However, we will not reduce your rights under this Policy without your explicit consent. We will publish the updated version on the Cherry on Art website and mini program, and prior to its effectiveness, we will notify you of the changes through platform announcements, in-platform notice or other means. Please review the latest version regularly.

1.2 For material changes, Cherry on Art will provide more prominent notice (including, but not limited to, in-platform notice, emails, or platform announcements) and seek your renewed consent.“Material changes” include, but are not limited to:

(1) Addition or modification of purposes or methods of collection, use, storage, or sharing of personal information.

(2) Changes to the process for accessing, correcting, deleting personal information, or withdrawing consent.

(3) Changes in major recipients of personal information sharing, transfer, or disclosure.

(4) Updates or adjustments to encryption technologies, access control measures, or other security practices.

(5) Addition of new scenarios or recipients for cross-border transfers of personal information.

(6) Expansion or limitation of the user groups or scope of services covered by this Policy.

(7) Modifications to provisions regarding legal liability, dispute resolution, or jurisdiction.

(8) Adjustments to the collection, use, or protection of minors’ personal information.

(9) Significant changes in Cherry on Art’s ownership structure or organizational structure.

2. Contact Us

If you have any questions, comments, suggestions, complaints, or reports regarding this Privacy Policy or your personal information, you may contact us via email at Hello@cherryonart.com or through our online customer service.