Legal法律

Privacy Policy隐私政策

What data we collect, why we need it, who we share it with, and the choices you have. Our promise in one line: we collect the minimum we need to move your packages, store it for as long as we have to, and never sell it.我们收集哪些数据、为什么需要、与谁共享、您有哪些选择。一句话承诺：我们只收集转运所需的最低限度数据，按规定时长保存，绝不出售。

Last updated: August 28, 2026 · Effective: August 28, 2026最后更新：2026 年 8 月 28 日 · 生效：2026 年 8 月 28 日

At a glance一览

We collect only what we need: account info, shipping address, parcel content, payment, and basic device data to run the service.我们只收集必要信息：账户资料、收货地址、包裹内容、支付信息以及运行服务所需的基础设备数据。
We share it with carriers, customs, payment processors, and cloud vendors under written agreements — never for advertising.我们仅在书面协议下与承运商、海关、支付处理方和云服务商共享，不会用于广告。
You can access, correct, export or delete your data. Email privacy@xtoobox.com.您可以访问、更正、导出或删除您的数据，邮件至 privacy@xtoobox.com。

1. What we collect一、我们收集哪些数据

Account: name, email, phone, password (hashed), and language preference. Shipping: receiving and delivery addresses, parcel tracking numbers, declared contents and value, photos taken at intake. Payment: card details handled by our PCI-DSS payment processor; we store the last 4 digits and brand. Service usage: pages viewed, features used, language, basic device and IP data for security and fraud prevention. Support: anything you share with us when you contact support.账户信息：姓名、邮箱、电话、密码（哈希存储）和语言偏好。运输信息：收发货地址、运单号、申报品名与价值、入库照片。支付信息：信用卡信息由我们通过 PCI-DSS 合规的支付处理方处理，我们仅保存卡号末四位与品牌。使用情况：浏览页面、使用的功能、语言、设备与 IP 等基础信息（用于安全与风控）。客服沟通：您主动提交给我们的内容。

2. Why we use it二、我们如何使用

To operate the service (receive, photograph, consolidate, ship, deliver, support), to prevent fraud and abuse, to meet legal and tax obligations, to send service notifications and (with consent) product updates, and to improve the product. We do not build advertising profiles and we do not sell your data.用于提供服务（收货、拍照、合箱、发运、配送、客服）、防止欺诈与滥用、履行法律与税务义务、发送服务通知和（在您同意时）产品更新、以及改进产品。我们不构建广告画像，也不出售您的数据。

Carriers and last-mile partners (for shipping), customs and tax authorities (where required by law), payment processors (for billing), cloud hosting and email vendors (under written data-processing agreements), and analytics providers that receive only aggregated or pseudonymized data. We disclose data if compelled by valid legal process.承运商与末端配送伙伴（用于运输）、海关与税务等主管部门（依法要求时）、支付处理方（用于结算）、云服务与邮件服务商（在书面数据处理协议下）、以及仅接收汇总或匿名化数据的分析服务方。在有效法律程序要求时，我们亦会依法披露。

4. Cookies and similar四、Cookie 与类似技术

We use first-party cookies and local storage to keep you signed in, remember your language preference and improve the site. We do not use third-party advertising cookies. You can clear cookies in your browser at any time; doing so will sign you out.我们使用第一方 Cookie 与本地存储来保持登录、记忆语言偏好和优化站点。我们不使用第三方广告 Cookie。您可随时在浏览器中清除 Cookie；清除后您将退出登录。

5. Retention五、保存期限

Account data is kept while your account is active and for up to 7 years after closure for tax and audit purposes. Shipment records are kept for the period required by applicable transport and customs law (typically 5–7 years). Inbound photos are kept for 24 months. Support tickets are kept for 24 months.账户数据在账户有效期间保留，并在账户关闭后因税务与审计需要保留最多 7 年。运单记录按运输与海关法律规定的期限保存（通常 5–7 年）。到仓照片保存 24 个月。客服工单保存 24 个月。

6. Your rights六、您的权利

You can access, correct, export or delete your data, and withdraw consent for marketing emails, by emailing privacy@xtoobox.com. We respond within 30 days. If you are in the EEA, UK or California, you also have the right to lodge a complaint with your local data-protection authority.您可以通过 privacy@xtoobox.com 访问、更正、导出或删除您的数据，并撤回营销邮件的同意。我们会在 30 天内回复。如果您位于 EEA、英国或加州，您还有权向当地数据保护机构投诉。

7. Security七、安全

We use TLS in transit, AES-256 at rest, role-based access control, two-factor authentication for staff and full audit logs for sensitive operations. No system is perfectly secure; if we identify a breach affecting your data, we will notify you and the relevant authorities as required by law.我们使用传输 TLS、静态 AES-256 加密、基于角色的访问控制、员工双因素认证以及对敏感操作的完整审计日志。任何系统都无法做到绝对安全；如果发生影响您数据的安全事件，我们将依法通知您与相关主管部门。

8. International data transfers八、跨境数据传输

Your data is stored in our Hong Kong and Singapore data centers and accessed by our team in Shenzhen, the United States and Singapore. We rely on standard contractual clauses and equivalent safeguards to protect data in transit between regions.您的数据保存在我们的香港和新加坡数据中心，由深圳、美国和新加坡的团队按需访问。我们采用标准合同条款（SCCs）等同等的跨境传输保障机制。

9. Children九、儿童

XtooBox is a business service and is not directed to children under 16. We do not knowingly collect data from children. If you believe a child has provided us with data, contact privacy@xtoobox.com for deletion.XtooBox 是面向商业场景的服务，不面向 16 岁以下儿童。我们不会明知而收集儿童数据。如有儿童向我们提交了数据，请联系 privacy@xtoobox.com 删除。

10. Changes to this policy十、政策变更

We update this page when our practices change. Material changes are announced on the dashboard and by email at least 14 days before they take effect, with a summary of what changed.我们的做法如有变化，会更新本页。重大变更会在生效前至少 14 天通过云仓后台和邮件告知，并附变更摘要。