Privacy Policy

1. Who is responsible and how to contact us

LI MULING, an individual operator based in mainland China, operates NewSite.cv and is its personal information handler (data controller), referred to as "we", "us", or "our" in this Policy. This Policy explains how we handle personal information in connection with our website research service. We determine the purposes and means of the processing described in this Policy.

Contact [email protected] for privacy questions and requests, including if you do not have an account or cannot sign in. Signed-in users may also open a support ticket. Our Terms of Service cover purchases, cancellation, and refunds.

This Policy is a notice about data processing, not a request for blanket consent. Where a particular activity legally requires your consent, accepting the Terms or continuing to browse does not replace that separate consent.

2. Information we receive

We process information connected with the features you use:

• Accounts and authentication: name, email address, verification status, password hash for password-based accounts, avatar if supplied, account identifiers, and account creation or update times. When you choose an available third-party sign-in option, we receive the profile details and authentication identifiers or tokens needed to establish and maintain that sign-in.
• Sessions and technical information: IP address, browser or device information contained in the user agent, session identifiers and expiry, request and error information, language preferences, and referral information associated with registration. These support sign-in, security, troubleshooting, and service operation.
• Orders and subscriptions: your account and billing email, purchased plan, amount, currency, payment provider, order and transaction references, payment status, subscription periods, cancellation status, and related billing or refund correspondence. We do not store full payment card numbers or card security codes.
• Support and uploads: messages, feedback, tickets, replies, and attachments you choose to send, together with the identifiers and timestamps needed to handle them. Images uploaded as avatars or attachments may be accessible to anyone with their image URL; do not include identity documents, payment credentials, or other sensitive material in those uploads.
• Account features: API-key records and invitation-redemption records when you use those features.
• Usage information: pages visited and feature interactions when analytics tools are enabled, as described in Section 4.

The research directory also contains information about third-party websites and keywords. If directory content identifies you and you believe it needs correction or removal, contact us with the relevant page and your request. Please do not send unnecessary sensitive information about yourself or other people.

3. Purposes and legal bases

Where a data protection law requires us to identify a legal basis, we use the following bases as applicable:

• Providing the account and requested service: performing our agreement with you, including authentication, paid access, subscription management, and support.
• Billing, refunds, and transaction reconciliation: performing the agreement, and complying with applicable accounting, tax, or other legal obligations.
• Security, fraud prevention, service reliability, and resolving complaints: our legitimate interests in protecting users and operating a reliable service, balanced against your rights, or a legal obligation where applicable.
• Necessary communications: performing the agreement or our legitimate interests in informing you about billing, account security, and material service or policy changes.
• Usage analysis and service improvement: legitimate interests where permitted; consent where required for the particular tracking or processing activity.
• Optional marketing: your consent where required. Marketing is separate from the service communications described in Section 9.

If you do not provide information necessary to create an account or complete a purchase, we may be unable to provide that function. We do not use this Policy to authorize unrelated uses of personal information.

4. Cookies, local storage, and analytics

Authentication and security cookies maintain your session and protect core functions. Preference storage remembers choices such as language and appearance. You can remove or block cookies and local storage in your browser, although blocking necessary cookies may prevent sign-in or other requested features.

When enabled on the website, Google Analytics processes usage and device information to measure how the site is used; see Google's Privacy Policy. When Plausible Analytics is enabled, it provides website usage statistics; see Plausible's Data Policy. Their processing depends on the tool and its active configuration; not all usage statistics are necessarily anonymous.

Embedded support tools, when enabled, may also use cookies or similar identifiers as described in Section 5. You may contact [email protected] about the tools in use or to object to processing where applicable. This Policy does not imply that browser settings replace consent where prior consent is legally required.

5. Payment processing and other disclosures

We do not sell your personal information. We disclose information only as needed for the following purposes:

• Payment processing: the payment provider identified at checkout receives the buyer email, product and order references, amount, and currency needed for the payment. Payment credentials are handled by that provider and its payment partners under their applicable payment and privacy terms; full card numbers and security codes are not stored on our servers. We receive order, payment, and subscription results to provide access, reconcile transactions, and handle support. Review the provider's privacy notice for its own processing, including fraud prevention and legal obligations.
• Hosting, storage, and service email: providers process the information needed to host the website, store account data or uploads, and deliver account or service messages on our behalf.
• Optional sign-in: when offered and chosen, Google or GitHub processes the sign-in exchange. Their policies are available from Google and GitHub.
• Analytics and embedded support: the analytics tools described above receive relevant usage information when enabled. If an embedded Crisp or tawk.to support tool is enabled, that provider may receive browser information, identifiers, and messages you send through it. See Crisp's Privacy Statement and tawk.to's Privacy Policy.
• Legal requirements and protection: we may disclose necessary information to comply with a lawful request, protect legal rights, or investigate fraud or a security incident.
• A business transfer: relevant information may transfer as part of a merger, acquisition, or transfer of the service, subject to applicable safeguards and any notice required by law.
• Your instructions: we may disclose information for another purpose when you specifically request it or provide the required consent.

We limit access by service providers to the information needed for their role. Where required, their processing must be governed by appropriate contractual data-protection obligations. A provider may also be independently responsible for processing it carries out to meet its own legal or payment obligations.

6. Security

We use measures appropriate to the service, including protected authentication, password hashing, authorization checks, and restricted administrative access. HTTPS protects information transmitted to the production website. No system can guarantee absolute security; keep your credentials private and report suspected incidents to [email protected].

If a personal-data breach occurs, we will investigate and meet applicable notification duties. Where the GDPR requires notification to a supervisory authority, it must be made without undue delay and, where feasible, within 72 hours after awareness. Where a breach is likely to create a high risk to individuals and notification is required, affected people will be informed without undue delay. Different applicable laws may impose different requirements.

7. Retention and deletion

Canceling a subscription stops renewal; it does not automatically delete the account. We retain personal information according to its purpose and the obligations attached to it:

• Account and authentication records: while needed to maintain your account. Information no longer needed is deleted or anonymized when a valid account-closure or deletion request is processed, subject to the exceptions below. Session and verification credentials have their own validity periods; expiry of a credential does not necessarily delete every related record.
• Payment and subscription records: for the applicable accounting, tax, payment-dispute, and legal-claim retention requirements. The applicable obligation and any unresolved claim determine the period.
• Support messages and attachments: for handling the request and any associated refund, complaint, or legal claim. Continued retention is limited to information needed for those purposes.
• Security and operational records: for investigating incidents, troubleshooting, and protecting the service, limited by the purpose and any applicable legal requirement.
• Backups and provider-held records: deletion requests must also account for backup copies and records held by relevant providers. Some records may need to remain restricted until they can be erased or their required retention ends.

We do not promise that all records disappear immediately on cancellation. For a deletion request, we will explain any information we must retain and the applicable reason or retention criterion. Retained information must not be reused for unrelated purposes.

8. Your privacy rights

Depending on the law that applies to you, you may request information about processing, access or a copy, correction, deletion, restriction of processing, and a portable copy of eligible data. You may also object to processing based on legitimate interests, object to direct marketing, or withdraw consent for future processing without affecting the lawfulness of earlier processing. You may complain to the competent data-protection authority.

You can change your name and avatar in Settings → Profile. If you have never paid and have no ongoing subscription or pending payment, you can also confirm account closure there. If you have paid before, including refunded payments, email [email protected] for account closure. Contact the same address for export, further data deletion, or other requests. Account closure revokes account access; retention of necessary transaction and service records is described in Section 7. We may ask for proportionate information to verify your identity; do not send a password or full payment card details.

We respond without undue delay and within the period required by applicable law. For GDPR requests, this is generally one month from receipt. If a permitted extension is needed because of complexity or the number of requests, we will explain it within that initial period. Requests and rights are subject to applicable conditions and exceptions. We will explain any refusal and available complaint options, and will not penalize you for lawfully exercising your rights.

9. Service messages and marketing

Account verification, password resets, billing, security, and important service notices are necessary communications associated with using the service. They are distinct from optional promotional messages.

If we send optional marketing, you can ask us to stop by emailing [email protected] or using an unsubscribe option included in the message. Opting out of marketing does not stop necessary service messages.

10. International processing

Depending on the location of the website infrastructure and the providers used for a particular feature, your information may be processed outside your country of residence, where data-protection rules may differ.

You may contact [email protected] for information about relevant processing locations and applicable safeguards. Transfers subject to legal restrictions require a permitted mechanism, such as an applicable adequacy decision or approved contractual safeguards. Accepting this Policy does not waive those requirements or itself establish a transfer safeguard.

11. Children

The service is intended for people aged 18 or older. We do not knowingly collect personal information from children under 18. If you believe a child has supplied information, contact us so we can investigate, restrict the account where appropriate, and address deletion in accordance with applicable law.

12. Third-party websites

Directory links and other external links lead to services with their own privacy practices. Visiting them or loading resources hosted by them can disclose information, such as your IP address and browser information, to those operators. Read their notices before providing information. This Policy describes our handling of information and does not replace their notices.

13. Changes to this policy

We update the date above when this Policy changes. Material changes affecting existing users will be announced at least 15 days before taking effect, by email or a prominent service notice. Where a legal or urgent security requirement prevents that notice period, we will explain the change as soon as reasonably possible. We will obtain fresh consent where required; continued use alone does not authorize a new consent-based purpose.

14. Contact

Operator and personal information handler (data controller): LI MULING, an individual operator based in mainland China.

Privacy, data-rights, security, and support requests: [email protected]. Include the account email, if applicable, and a description of your request. For a directory-related request, include the page or website concerned. Signed-in users can also use support tickets; an account is not required to contact us by email.