Privacy Policy

Welcome to the official TINTAShift website (hereinafter, “this Website,” “we,” or “us”). We understand how important personal information is to you, and protecting your privacy and personal information security is a core operating principle. This Privacy Policy is formulated in accordance with applicable laws and regulations, including the Personal Information Protection Law of the People’s Republic of China, the Cybersecurity Law of the People’s Republic of China, the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), and explains how we collect, use, store, share, and protect your personal information and the rights you may exercise under applicable law.

This Privacy Policy applies to all scenarios in which you access this Website, register an account, purchase products, subscribe to communications, contact customer service, or otherwise interact with us. By using this Website, you confirm that you have read, understood, and agree to all terms of this Privacy Policy. If you do not agree, please do not use any services on this Website.

1. Scope of personal information we collect

1.1 Personal information you actively provide

To provide our services, we collect only the minimum information you actively provide that is necessary to complete the relevant action:

• Account registration: name, email address, phone number, and login password (stored in encrypted form);
• Orders and purchases: consignee name, shipping address, and phone number; payment information is processed by third-party payment providers—we do not store full card numbers, payment verification codes, or similar sensitive payment data;
• Newsletter subscription: the email address you voluntarily submit;
• Customer service / feedback: name, contact details, and the content of your inquiry that you voluntarily provide.

1.2 Technical information collected automatically

When you browse this Website, we automatically collect non-identifying technical data solely to ensure security and optimize experience:

• Device information: IP address, browser type, operating system, device model, etc.;
• Browsing behavior: visit time, pages viewed, session duration, referrer, and similar anonymized data;
• IP-based region information: used only to determine the user’s region for intelligent routing and partitioned data storage;
• Cookies and similar technologies: used for basic functionality, service stability, and experience optimization; you may manage your preferences at any time.

1.3 Information obtained from third parties

Only where you have given clear authorization or where it is necessary for our business, we obtain the minimum information required for order fulfillment from third-party service providers such as payment and logistics providers, and we require them to strictly fulfill confidentiality obligations.

2. Purposes and rules for using personal information

We use your personal information only within the following lawful, reasonable, and necessary scope:

• Order fulfillment: order confirmation, shipping, logistics tracking, and after-sales handling;
• Customer service: responding to inquiries, handling suggestions, and providing support;
• Account administration: identity verification, security maintenance, and account deletion;
• Regional routing and data storage: determining region based on IP address to implement domestic/overseas partitioned storage;
• Website improvement: analyzing anonymized visit data to optimize pages and services;
• Security and compliance: risk prevention, security assurance, and fulfillment of legal obligations.

3. Sharing and disclosure of personal information

We will never sell, trade, or unlawfully transfer your personal information. Without your separate consent, we will not share your personal information with any third party. We share information only in limited, lawful circumstances:

• Service providers: sharing the minimum information necessary with logistics, payment, cloud storage, technical maintenance, and other partners to perform services;
• Legal compulsion: disclosure as required by laws and regulations or lawful instructions from judicial or administrative authorities;
• Business merger / reorganization: user information may transfer as part of business assets; we will notify you in advance and ensure continuity of privacy protections;
• Your explicit authorization: targeted sharing only after your separate, clear consent.

4. IP-based regional routing and data storage rules

This Website uses an IP-based regional determination + partitioned storage isolation mechanism to help ensure compliance and security:

• Users in Mainland China: all personal information, account data, order information, and usage records are stored entirely on compliant servers located in Mainland China, with no cross-border transfer.
• Users outside Mainland China: all personal information, account data, and order information are stored on compliant servers located in the United States.
• IP addresses are used only for regional determination and routing, not for precise geolocation, not shared externally, and not used for commercial marketing.
• The system completes regional identification and storage routing automatically; no manual action is required.

5. Cross-border transfer statement

Based on the storage rules above:

• Data of users in Mainland China is not cross-border transferred and is processed and stored entirely within Mainland China.
• Data of overseas users is stored in the United States in a manner consistent with applicable data protection laws such as the EU GDPR and California CCPA/CPRA, as applicable.
• All processing activities strictly comply with the Personal Information Protection Law of the People’s Republic of China and applicable cross-border data rules.

6. Security measures

We adopt industry-leading safeguards to protect your personal information, including:

• End-to-end encryption in transit using SSL/TLS;
• Encryption at rest, de-identification where appropriate, and role-based access controls;
• Periodic security audits, vulnerability testing, and security drills;
• An information security incident response plan.

If a leakage, tampering, loss, or other security incident occurs, we will immediately take remedial measures, report to regulators within 72 hours where required, and notify affected users in a timely manner.

7. Retention period

We follow the principles of minimum necessity and shortest retention:

• Order transaction information: retained for 3 years;
• Customer service records: retained for 1 year;
• Basic account information: retained until account deletion;
• After account deletion: deletion or anonymization within 15 business days.

8. Your legal rights

You may have the following rights under applicable law:

• Right of access: inquire about the collection, use, and storage of your personal information;
• Right to rectification: correct inaccurate or incomplete personal information;
• Right to erasure: request deletion where legally permitted;
• Right to withdraw consent: withdraw consent at any time (without affecting prior lawful processing);
• Right to account deletion: request account closure and deletion of associated personal data;
• Right to data portability: request export of your personal information where applicable;
• Right to complaints and feedback: raise concerns about this Policy or our processing activities.

9. Protection of minors

Products and services on this Website are intended for adults aged 18 and over. We do not knowingly collect information from minors. If we learn that we have collected information from a minor, we will delete it permanently without undue delay. Guardians may contact us to request deletion.

10. Updates to this Policy

We may revise this Privacy Policy as laws and regulations evolve or our business changes. Updates will be posted on this page with a new “last updated” date. If changes are material, we will notify you in advance via website announcements or email. Continued use of our services constitutes acceptance of the updated Policy.

11. Contact us

If you have any questions, objections, or requests to exercise your privacy rights, please contact us:

© 2026 TINTAShift. All rights reserved. TINTAShift is a trademark of Prism Institute (Shanghai) Co., Ltd. (上海棱境工坊科技有限公司).