This is a translation of the Chinese version for reference only; in case of any discrepancy, the Chinese version shall prevail.
Dukou API (“we”) respects and protects your privacy. This Privacy Policy (“Policy”) explains how we collect, use, store and share your personal information when you use Dukou API (the “Service”), as well as the rights available to you under law.
Please read this Policy carefully before using the Service. By using the Service, you confirm that you have read and agree to this Policy. We may update this Policy from time to time. We will notify you in advance of material changes by email to your registered address or through an on-site notice.
The data controller for this Service is:
We do not collect your location information and do not offer third-party (social) account sign-in.
| Purpose | Legal basis |
|---|---|
| Providing and maintaining the Service | Performance of a contract |
| Billing and payment processing | Performance of a contract |
| Customer support | Performance of a contract / legitimate interests |
| Service notices (billing, security and policy updates) | Legitimate interests |
| Security, fraud prevention and abuse detection | Legitimate interests |
| Product improvement and analytics | Legitimate interests |
| Legal compliance | Legal obligation |
We may aggregate or de-identify data for statistical analysis. Such data cannot identify a specific individual.
| Type | Purpose | Can be disabled |
|---|---|---|
| Strictly necessary | Maintaining sign-in state and core functions (session token) | No |
| Functional | Personal settings such as language preference and interface theme | Yes |
We do not use third-party advertising trackers or pixels. On-site traffic statistics are based on our own server logs; your personal information is not sent to third-party analytics platforms. You can adjust cookie preferences in your browser settings.
We do not sell your personal information, including as “sale” is defined under applicable laws such as the CCPA. We share information only in the following circumstances:
If a security incident affects your rights, we will notify you and relevant regulators within 72 hours of discovery, as required by law. Keep your account credentials secure and do not share them.
| Data type | Retention period | Disposition |
|---|---|---|
| Account information | While the account is active; 90 days after closure | Deletion or anonymization |
| Transaction and top-up records | As required by tax and accounting obligations, typically 5 years | Deletion or archiving |
| Customer support communications | 2 years | Secure deletion |
| API call logs | 6 months | Secure deletion |
| Security audit logs | 12 months | Secure deletion |
To exercise the rights below, contact us using the details in Section 14. We will process your request within 30 calendar days.
| Right | Description |
|---|---|
| Right to be informed | Learn what data we collect and use |
| Right of access | Obtain a copy of your personal information |
| Right to rectification | Correct inaccurate or incomplete information |
| Right to erasure | Request deletion of data in certain circumstances |
| Right to restriction | Pause processing in certain circumstances |
| Right to data portability | Receive your data in a machine-readable format |
| Right to object | Object to processing based on legitimate interests |
| Right to withdraw consent | Withdraw authorization for processing based on consent |
If you believe we have not handled your information properly, you have the right to complain to the data protection authority in your jurisdiction.
We send service- or event-related marketing emails only where you have actively consented. You may unsubscribe at any time by clicking the “Unsubscribe” link in an email or contacting us. Unsubscribing does not affect necessary service notices, such as billing, security alerts and policy updates.
Our servers are located in the Hong Kong Special Administrative Region. Some service providers (cloud infrastructure, payment processing and upstream model services) may be located in other jurisdictions. We protect data in cross-border transfers by:
The Service is intended for users aged 18 or older. We do not knowingly collect information from minors below this age. If you believe a minor has provided us with information, contact us immediately and we will delete it as soon as possible.
The Service may contain third-party links or integrate with third-party services (such as client tools you connect yourself). This Policy applies only to information we collect directly. We are not responsible for third parties' data practices; please review their policies before use.
For material changes, we will notify you at least 15 days in advance through an on-site notice or your registered email, and update the “Last updated” date at the top of this page. Continued use after the effective date constitutes acceptance.