Responsible organization
上海盛迭信息科技有限公司 is responsible for personal information processing in STHBox platform services. Contact help@sthbox.com for privacy matters. This notice covers accounts, subscriptions, file processing and APIs. Businesses or survey creators determining separate collection purposes must also provide their own notice.
Information and purposes
Accounts and security: email or phone number, display name, password hashes, language preference, verification records, sessions and necessary security audit records support registration, authentication, recovery, abuse prevention and account management.
Workspaces and billing: business names, membership and permissions, invitations, subscriptions, orders, credits and usage records support access, settlement and investigation. When payment channels are available, payment providers process payment information under their rules; STHBox processes transaction status and identifiers needed for orders.
Files and tasks: submitted files, names and metadata, recognized text, edits, outputs and status support your storage, parsing, conversion, editing, downloads and requested sharing. Only submit personal information you are lawfully entitled to process.
Surveys: questions, collection settings, responses, distribution and statistics support surveys and analysis. The creator explains the collection purpose; read the survey notice before responding.
Operations and support: necessary access logs, potentially including IP addresses, timestamps and errors, task IDs and information you provide to support help protect and troubleshoot the service. Browsing product descriptions does not require unrelated personal details.
Legal grounds and choices
Processing relies on applicable grounds such as necessity for a contract with you, legal obligations or valid consent. Consent-based optional processing can be withdrawn as provided by law; refusing unnecessary processing does not remove basic service access.
Sensitive information, disclosures to independent recipients and other cases requiring separate consent are subject to their own notices and authorization. This notice is not blanket permission.
Components and recipients
Phone verification uses Aliyun SMS. When you request registration, sign-in or phone linking, we provide the receiving phone number, verification template and necessary request identifiers to send the code and record processing status. Passwords and document contents are not sent. You can link and verify a phone or email in account settings. Recipient, session, network and service-wide budgets limit verification requests.
Email uses the Sundear business account in RelayNest. Necessary email addresses, language, template variables and delivery records support verification, security and subscription messages. Where contact synchronization is enabled, necessary contact details and account status are synchronized, not passwords or document bodies.
PDF/OCR services and Transmute conversion nodes receive necessary files and parameters to execute tasks and return outputs; configured storage holds originals and results. Processing nodes do not make files public. Components are not authorized to reuse content for unrelated purposes.
Connected applications such as CaseDeck receive authorized account identifiers, workspace identity, seats and entitlements. Additional collection by an application follows its notice. Service providers must be constrained by purpose, scope and security requirements; independent disclosures follow applicable notice and consent obligations.
Business workspaces and sharing
Authorized business owners and administrators manage members, seats, subscriptions and shared usage. Content visibility depends on actual feature permissions and sharing settings; joining a business does not automatically publish all content.
Recipients may redistribute survey links, presentation codes and downloaded files. Survey creators can access and export authorized responses. Respondents may contact the creator or ask us to help with rights requests.
Browser storage and security
Necessary session cookies keep you signed in. Browser storage remembers language, interface preferences and some unfinished operations. Clearing it may sign you out or require you to select files again.
We use access controls, password hashing, transport protection and auditing. No measure removes all risks. Personal information incidents will be addressed, notified and reported as required by law.
Retention, deletion and international transfers
Retention follows the shortest period necessary for the relevant purpose and applicable legal requirements. Account content, pending tasks, orders, credits and security records serve different purposes; task completion does not mean every record is immediately deleted. Recycle bins, temporary copies and backups can have different deletion states.
When deletion, account closure or completed purposes make information unnecessary, it will be deleted or anonymized as legally required. Where legal retention or technical constraints prevent immediate deletion, processing is restricted to storage and necessary security protection. Ask us about the retention or deletion of specific data.
Choosing a language is not consent to an international transfer. Any change involving cross-border personal information transfers must follow applicable notice, separate consent and other required procedures.
Your rights and minors
Edit available profile details in account settings and use available content download and deletion controls. Email help@sthbox.com to request access, copies, correction, deletion, withdrawal of consent, account closure or an explanation of processing. Requests without a self-service option are handled manually after proportionate identity and authority checks.
Where other members’ rights or legal retention duties apply, we will explain the boundaries and response. Reasons will be given for requests that cannot be met, without excluding lawful complaints or court remedies.
The service is intended primarily for businesses and individuals with appropriate legal capacity. Minors should use it with guardian guidance. Processing information about children under fourteen requires guardian consent and special protection under applicable law. Contact us about information collected without appropriate authorization.
Updates
Material changes to purposes, scope or recipients will be communicated appropriately. Continued browsing does not replace fresh consent where required. Contact help@sthbox.com for explanations or information about versions.