Privacy Policy

1. Scope and legal bases for processing

This policy applies to image storage, display, sharing and related services provided by 云图 IMGCC. It explains how we collect, retain, use, entrust, provide, disclose and delete personal information. Services provided independently by third parties are governed by their own rules. This does not remove our responsibility for selecting and using those services.

We process personal information in accordance with the Personal Information Protection Law, Cybersecurity Law and Data Security Law of the People's Republic of China, the Regulations on Network Data Security Management and other applicable rules. Processing is limited to what is necessary to provide the services you request, fulfill legal obligations, act on your valid consent, or meet other statutory grounds. “Improving the experience” is not a basis for unlimited collection.

Reading or browsing this page, or generally agreeing to the Terms of Service, does not replace any separate consent required by law.You may withdraw consent for processing based on consent. Refusing optional processing unrelated to a particular service will not prevent you from using other features that do not depend on that information.

2. Information processed, purposes and methods

• Accounts and login:The username, email address, password and verification information you provide during registration are used to create your account, authenticate your identity, recover your password and secure your account. During login we process session identifiers, login times, IP addresses and security records. Without the required registration information, an account cannot be created, but public pages that do not require login remain accessible.
• Uploads and media management: We process uploaded files and their names, formats, sizes, dimensions, upload times and identifying markers, along with the associated account, album, title, description and visibility settings, to store, display, share, identify duplicates and delete media. Files may themselves contain likenesses, capture times, device models and location information.
• Media organization: We automatically analyze uploaded media to generate tags for organization and search, and analyze public media to select content for display. Non-public media is also tagged, but this does not make it public. Tags may be inaccurate; you can correct them through media management or contact us to request a correction.
• Profiles and interactions: Profile details you provide, such as your display name, avatar and biography, and records of comments, replies, likes, follows and reports are used to display information you choose to make public, support interactions and notifications, handle complaints and maintain content safety. Optional profile details are not required for basic account features.
• Access and security: IP address, access time, pages visited, browser and operating system information, access results, and necessary login and security records are used to deliver the service, prevent attacks, investigate faults and meet network security obligations. Section 5 explains information used for security verification.
• Content safety: Uploaded images, animated images, videos and their audio, titles, descriptions, tags and comments, together with review results, actions and notices, are processed to identify violations and handle reports, reviews and appeals. Staff may process content only within necessary permissions and scope. See the Terms of Service for automated actions and human review.
• Contact and rights requests: We use the name, contact email, links, description, necessary evidence of rights or identity, and correspondence you provide to reply, handle complaints and verify your authority to make a request. Redact unrelated people's information and do not send passwords or other access credentials.

This information is submitted by you, transmitted by your browser in requests, or generated when the relevant service is provided. Agreeing to this policy alone does not grant us permission to read your device's contacts, entire photo library or precise background location. Selecting files in your browser allows us to process only the files you actually choose to upload.

3. Public sharing, metadata and sensitive personal information

Public media, albums, titles, descriptions and profile details may be viewed, copied, downloaded or indexed by search engines. Sharing file links may expand access. Changing visibility cannot retrieve links already shared or files others have saved.

Files may retain capture location, time and device information. Information not shown on the page may still be present in a downloaded file. Check files before uploading and remove information you do not need to retain.

Identity documents, financial accounts, health information, precise location, biometrics and personal information of children under 14 may constitute sensitive personal information. Our basic image service does not require you to provide such information; do not upload or disclose it as ordinary material. Before using another person's personal information, confirm that you have a lawful basis to process and disclose it. Owning an image's copyright does not mean you have authorization to use the personal information of the people depicted.

Where it is necessary to process sensitive personal information, disclose personal information or provide it to another independent controller, we must explain the specific purpose, necessity, categories, processing methods and possible effects, take strict protective measures, and obtain separate consent where required by law. This policy must not be treated as a one-time blanket authorization.

4. Cookies and similar technologies

We use necessary cookies and similar identifiers to maintain login, remember your interface preferences and perform security verification. These identifiers may be set by us or by third parties providing those services.

Session cookies are generally cleared according to your browser's session-ending rules. Persistent cookies expire at the time shown in your browser and may also become invalid when you log out or clear them manually. You can view, delete or restrict cookies through your browser. Restricting necessary cookies may prevent login, uploads or verification from working properly. Random identifiers in cookies may also constitute personal information and are not necessarily anonymous.

New uses such as optional analytics or advertising tracking require a separate explanation in advance and consent where required by law. This policy alone does not extend permission for necessary login or security cookies to advertising tracking.

5. Third-party services, entrusted processing and lawful disclosures

We use third-party services for site operation and storage, media organization, content review, security verification and email. We provide each service only the information it needs.

• Site operation and storage: account details, uploaded media, IP addresses, access information and necessary records are processed to store media, provide access and protect the service.
• Media organization and content review: images, animated images, videos, their audio and related text are analyzed to generate tags, select public content for display and identify rule violations. Necessary content identifiers and analysis results are also processed. Automatic tagging also covers non-public media without making it public.
• Human verification: when an action triggers verification, IP addresses, browser environment, security cookies, interaction information and verification results are processed to prevent automated abuse.
• Email notices and contact: sender and recipient addresses, message content, attachments, sending times and delivery records support account notices, support and appeal responses. Please provide only information needed to resolve your request.

For overseas recipients, contact details, processing scope and rights procedures, see Third-party Processing Details, which forms part of this policy.

For entrusted processing, we should agree on the purpose, duration, methods, information types and security obligations as required by law and supervise the processor. Third-party terms do not replace our own protection obligations.

We do not sell personal information. When providing information to another independent controller, we must inform you of the recipient and specific processing details and obtain separate consent where required by law. If a merger, transfer or similar event changes the controller, we must notify you of the recipient and require it to continue fulfilling protection obligations. New consent must be obtained as required by law if the purpose or method of processing changes.

When cooperating with competent authorities under the law, we provide only necessary information after verifying the request and authority. Where materials must lawfully be forwarded to relevant parties when handling infringement complaints or counter-notices, we forward only necessary parts and take reasonable measures to protect contact details and unrelated information.

6. Storage locations and overseas processing

Account details and uploaded media are primarily stored in mainland China. Some network access and security verification services involve overseas processing. Primary storage in mainland China does not mean that all information is processed only there.

For overseas recipients, contact details, processing scope and rights procedures, see Third-party Processing Details.You may email us to request access, deletion or restricted processing, identifying the relevant account, link or time. We should help verify and forward the request to the relevant service provider. You may also use the rights procedures in its privacy policy.

Overseas transfers of personal information must have a lawful basis and comply with applicable requirements for notice, separate consent, impact assessments and any required security assessment, standard contract or certification.The description of existing services on this page does not itself constitute your separate consent to an overseas transfer or replace any legally required procedure.If you object to specific overseas processing, you may request an explanation or restriction at the email address above. Features that require that processing may then become unavailable.

7. Retention periods and deletion rules

Information is retained for the shortest time needed to achieve its specific purpose, not indefinitely under a general claim of “business needs.” Retention periods and how they are determined are as follows:

• Account details and media:These are retained to provide the relevant features while you continue using your account and storage services. Once a valid deletion or account closure request is completed, information that is no longer necessary is deleted or anonymized, except where retention is required by law.
• Cybersecurity records:Retention is determined by applicable legal requirements. Network logs within the scope of the Cybersecurity Law are subject to a statutory minimum retention period of six months. Longer legal periods or valid preservation requirements take precedence. Information is deleted or anonymized once the period ends and it is no longer necessary.
• Complaint, appeal and moderation records:Retention is limited to the period needed to investigate, resolve objections and fulfill legal obligations, considering whether a dispute has ended, applicable statutory periods and valid preservation requirements. Access is restricted and the records are not used for unrelated purposes.
• Copies and backups: Some copies retained for access and backup may be cleared later than the media itself. We must clear them promptly according to their actual purpose, necessary retention period and legal requirements, and must not keep deleted media public or retain copies indefinitely. Information held by entrusted providers must also be deleted or returned as required by the agreement and law.

If a legal retention period has not expired or immediate deletion is technically difficult, all processing other than storage and necessary security protection should stop. When restoring backups, effective deletion or restriction requests must also be applied to avoid republishing deleted content. You may ask about the specific grounds for retaining your information and the progress of its handling.

8. Your rights and how to make a request

As provided by law, you have rights to be informed and decide, access, copy, correct, supplement, delete, restrict or refuse processing, withdraw consent and request explanations. Where applicable conditions are met, you may request transfer of personal information to a controller you designate.

• Self-service management:After logging in, use account settings or media and album management to view and change editable details, visibility settings and media you are authorized to delete.
• Requests by email:Send your request to mail@imgcc.cloud with a subject such as “Personal information rights request.” Include your account, the request and necessary information to locate the relevant data. Being banned or unable to log in does not prevent you from making a request by email.
• Account closure, copies and transfers:If the interface has no suitable option, use the email address above. We verify only information necessary to establish your authority to make the request and should not demand unrelated identity documents or impose unreasonable conditions.
• Withdrawing consent:Adjust the relevant settings or email us specifying the processing for which you wish to withdraw consent. Closing your entire account is not the only way to withdraw consent to optional processing. Withdrawal does not affect prior processing based on valid consent or necessary processing with another lawful basis.
• Automated decisions:If you disagree with content deletion, account restrictions or similar actions, you may request an explanation and human review. See the reporting and appeals rules.

We generally respond to ordinary requests within 15 working days. If further materials or investigation are needed, we will explain why and outline the next steps. Any shorter statutory deadline takes precedence. Reasonable requests are generally free of charge. If all or part of a request cannot lawfully be fulfilled, we should explain the basis and provide a further appeal channel. You may also complain to the competent personal information protection authority or bring proceedings before a competent people's court in accordance with the law.

9. Protection of minors' personal information

Users under 18 should use the service with a guardian's guidance.Personal information of children under 14 is sensitive personal information. Until specific notice and guardian consent arrangements are in place, do not register, upload or submit such information through this site.A minor checking a general terms box does not replace a guardian's consent.

If we discover that a child's information is processed without valid guardian consent or beyond what is necessary, we should promptly verify and delete or correct it as required by law, restricting processing of any portion that must legally be retained. Guardians may request access, correction, deletion or other rights through our email address, providing only the minimum materials needed to establish guardianship and locate the information. Content that threatens minors' safety is handled as a priority in accordance with the law.

10. Security, policy updates and contact

We take necessary security measures to prevent unauthorized access, disclosure, alteration or loss of personal information. Authorized staff and entrusted providers may process relevant information and content only as necessary to deliver the service and fulfill security obligations.

If personal information is or may be disclosed, altered or lost, we should promptly take remedial measures and report to the competent authorities and notify affected individuals as required by law. Notices include the information involved, possible harm, measures taken and steps individuals can take, and contact channels. Any lawful exception to individual notification is handled according to the law.

Changes to this policy will be dated on this page. Material changes to processing purposes, methods, categories or personal rights will be communicated prominently. Where renewed or separate consent is required by law, the relevant processing will begin only after valid consent is obtained; “continued use” will not be treated as blanket consent. This policy will not reduce your legal rights.

For questions about this policy, our data processing or your rights, contact mail@imgcc.cloud or use the contact page.