Privacy Policy · 隐私政策

Effective Date: October 1, 2026 · Last Updated: October 10, 2026 · Version: V1.1

1. Introduction & Data Controller

Welcome to BillVerse (the "Platform"), operated by HONG KONG CONNECT WORLD AFFAIRS LIMITED ("we", "us"). The Platform provides trade finance bill information display and inquiry matching services for international trading companies. We understand the importance of your personal information and are committed to protecting it.

This Policy applies when you use the Platform through the BillVerse app, website or other online channels, and explains how we collect, use, store, share, transfer and protect your personal information, as well as your rights and how to exercise them. By using the Platform you acknowledge that you have read and agree to this Policy.

Under this Policy, we act as the data controller (personal information processor) in respect of the personal information you submit through the Platform. If you have any questions, comments or complaints about this Policy, please contact us using the details in Section 13.

2. Information We Collect

We follow the principles of lawfulness, legitimacy, necessity and good faith, and collect only the information necessary to provide our services:

• Account & identity: company name, country/region, registration number, registered address, contact person, phone, business email;
• KYC documents: certificate of incorporation, UBO identification and supporting documents you upload (used solely for review and corporate verification);
• Business content: bill details (terms, scans, trade documents) and inquiry/message content you submit;
• Orders & payment proof: service order details, remittance voucher and payer information (used solely for verification);
• Technical logs: device model, OS, IP address, access time and operation records (for security audit and compliance).

We collect the above from: information you provide to us, and information automatically collected when you use the Platform. Some information is necessary to provide our services (e.g. corporate verification documents); if you do not provide it, we may be unable to provide the relevant services or complete necessary reviews.

App Permission Usage:

• Camera (CAMERA): invoked solely when you actively capture photos of business licenses, bill scans or remittance receipts for upload; never invoked otherwise;
• Photo Library (Read/Write): invoked solely when you actively pick or save images;
• Network State (ACCESS_NETWORK_STATE / ACCESS_WIFI_STATE): used to detect connectivity and prompt when offline;
• We do not request contacts, call logs, SMS, location or microphone permissions.

Third-party services: The app is built on the DCloud uni-app runtime and uses Alibaba Cloud uniCloud as its cloud infrastructure (cloud database, cloud storage, cloud functions). These providers process data only to the extent necessary to provide infrastructure and runtime services, under confidentiality and data-protection obligations. This Policy does not apply to third-party websites or services provided independently by third parties; please refer to their respective privacy policies.

3. How We Use Information & Legal Bases

We use your information for the following purposes:

• To operate the Platform, including registration, review, bill display and inquiry matching;
• To verify corporate identity and counterparty credentials and to prevent fraud, money laundering and abuse;
• To comply with legal obligations, security audit and record retention requirements;
• To improve our services, troubleshoot and protect system and data security;
• To send you necessary service notifications (review results, order status, security alerts).

Where required by applicable law, our legal bases for processing include:

• Performance of the service agreement with you;
• Compliance with our legal obligations (e.g. anti-money laundering and compliance record-keeping requirements);
• Our legitimate interests (e.g. fraud prevention, platform security and service improvement), provided such interests do not unfairly override your rights;
• Other circumstances with your consent. You may withdraw your consent at any time; withdrawal does not affect the lawfulness of processing based on consent before withdrawal.

Automated review: To ensure compliance and platform integrity, bill information undergoes cloud-based automated pre-screening and manual review before being displayed. Automated pre-screening is used only for preliminary checks such as completeness and compliance; final display is confirmed by human review. If you believe such processing significantly affects your rights, you have the right to request an explanation and a manual review.

4. Sharing & Disclosure

We do not sell your personal information. We may share it only in the following circumstances:

• Showing necessary public corporate information to service counterparties (e.g. showing a bill holder's company name and bill details to potential funders to facilitate matching);
• Providing necessary data to cloud, infrastructure and hosting providers bound by confidentiality obligations;
• Disclosing where required by laws, legal process or competent authorities;
• Other circumstances with your explicit consent.

We require our partners to process information only to the extent necessary and in accordance with this Policy and our instructions, under appropriate confidentiality and security measures.

5. International Transfers

As a global platform, your information may be transferred to and stored on servers located outside your jurisdiction (including but not limited to the locations of our cloud service providers). We take reasonable measures to ensure data security during transfer and storage; where required by applicable law, we adopt appropriate safeguards such as standard contractual clauses and necessary security assessments.

6. Data Security & Security Incidents

We apply industry-standard safeguards, including but not limited to salted password hashing, access control, encrypted transmission, operation auditing and least-privilege principles. Sensitive documents such as KYC materials are accessible only to authorized personnel for review and compliance purposes. However, no internet environment is absolutely secure — please keep your account credentials safe.

If a personal data breach, damage or loss occurs, we will promptly take remedial measures, notify affected users of the incident, its potential impact and our response as required by law, and report to competent authorities where required by law.

7. Data Retention

For audit and compliance purposes, account data, operation logs and review records are retained for at least 7 years from creation. After the retention period, we will delete or anonymize the information unless otherwise required by law. If you deactivate your account, we will delete or anonymize your personal information as required by law, except for records that must be retained under applicable laws.

8. Your Rights

To the extent permitted by applicable law, you have the following rights:

• Access & portability: export a full copy of your personal data (JSON) via Settings → Data & Privacy;
• Correction: update company details via Company Info / KYC pages;
• Deletion: self-deactivate your account via Settings → Danger Zone, which anonymizes your profile, takes down all your bills and freezes sign-in;
• Restriction, objection and withdrawal of consent: contact us using the details in Section 13; withdrawal does not affect the lawfulness of processing based on consent before withdrawal;
• Complaints: contact us below, or lodge a complaint with the competent supervisory authority in your jurisdiction.

If you are located in jurisdictions such as the EU, the UK or California, you may have additional rights under applicable local laws, which we will honor as required by law.

To protect security, we may need to verify your identity before processing your request. We will respond as soon as possible, usually within 15 business days. Certain records required by law may not be deletable during the retention period.

9. Minors

The Platform is a business-to-business service not directed at persons under 18. We do not knowingly collect personal information from minors; if we learn that a minor has registered or provided personal information, we will delete the relevant data as soon as possible. If you are a guardian with concerns, please contact us.

10. Cookies & Local Storage

We use local storage on your device to remember your session and language preferences. This is necessary for the service to function and does not track you across third-party sites. For details, please see our Cookies & Local Storage Policy.

11. Policy Updates

We may update this Policy from time to time. Material changes will be notified through prominent means such as in-app notifications or page announcements, and the updated Policy takes effect upon publication. Continued use of the Platform constitutes acceptance of the updated Policy.

12. Language

This Policy is published in Chinese and English. In case of any inconsistency between the two versions, the Chinese version shall prevail.

13. Contact & Complaints