隐私政策

更新日期：2026年7月16日

概要

上海补天石科技有限公司（以下简称“我们”）重视维护和保护用户的个人信息。本政策适用于我们面向中国境内用户提供的 Potentia Field App（以下简称“Potentia Field”或“本App”）及与本App相关的服务。

本政策将帮助您了解以下内容：

1. 我们如何收集和使用您的个人信息
2. 我们如何使用 Cookie 和同类技术
3. 我们如何使用 SDK
4. 我们如何共享、转让、公开披露您的个人信息
5. 我们如何保护您的个人信息
6. 您的个人信息权利
7. 您的个人信息如何在全球范围转移
8. 您的个人信息存储期限
9. 我们如何保护未成年人的信息
10. 本政策如何更新
11. 如何联系我们

我们深知个人信息对您的重要性，并会尽全力保护您的个人信息安全可靠。我们致力于维持您对我们的信任，并根据适用法律法规和业界成熟安全标准，采取相应的安全保护措施来保护您的个人信息。请在使用我们的产品或服务前，仔细阅读并了解本《隐私权政策》。

一、我们如何收集和使用您的个人信息

个人信息是指以电子或者其他方式记录的与已识别或者可识别的自然人有关的各种信息，不包括匿名化处理后的信息。我们仅会出于本政策所述的以下目的，收集和使用您的个人信息。

敏感个人信息是指一旦泄露或者非法使用，容易导致自然人的人格尊严受到侵害或者人身、财产安全受到危害的个人信息，包括生物识别、宗教信仰、特定身份、医疗健康、金融账户、行踪轨迹等信息，以及不满十四周岁未成年人的个人信息。

（一）注册、登录 Potentia Field 账号并开通采集权限

为完成账号创建、登录、身份识别和采集权限开通，您可能需要向我们提供或由您的团队管理员/供应商管理员为您开通以下信息：用户名、登录账号、电子邮箱地址或手机号（二者择一，由您选择提供）、密码、邀请码、所属团队或供应商、角色/权限信息。我们使用上述信息用于创建和管理您的 Potentia Field 账号、验证您的登录身份、确认您是否属于受邀采集员或内部项目人员，以及为您配置相应的采集任务权限。

目前，Potentia Field 仅通过受邀方式使用。账号注册需使用邀请码，您可自行选择以电子邮箱地址或手机号作为账号标识。我们使用该标识用于创建和识别您的账号、保障账号安全、提供账号找回、向您发送与账号及采集任务相关的通知，以及检测和防止重复注册或欺诈注册。为防止重复注册，我们会核验您提供的电子邮箱地址或手机号是否已被注册，并可能在您的账号注销后，仅为该目的继续保留该标识符或其不可逆加密形式。目前，我们不会向您的电子邮箱地址或手机号发送验证码，也不会核验您所提供的标识符是否归您本人所有。目前，我们不进行实名认证，也不通过 Potentia Field 处理结算或支付。如未来我们支持邮箱或短信验证、众包采集员注册、实名认证、结算功能或其他账号认证方式，我们可能会相应收集包括验证码、认证状态在内的其他个人信息，并可能委托第三方服务商发送相关消息；我们将在相关功能上线前按照法律法规要求更新本政策并另行征得您的同意。

（二）查看、领取和执行采集任务

当您查看、搜索、筛选、领取或执行采集任务时，我们可能会收集和生成与任务相关的信息，包括项目/任务名称、任务类型、任务指引、示范视频、批次信息、领取数量、任务状态、采集进度、上传状态、任务完成时间、任务反馈及与您的账号相绑定的操作记录。我们使用上述信息用于向您展示采集任务、支持您领取并完成采集任务、记录任务执行状态、进行任务管理和质量追踪。

（三）采集、保存和上传任务数据

Potentia Field 是用于采集任务数据的移动端 App。当您根据任务要求开始采集时，本App可能会调用您的摄像头/相机、麦克风、陀螺仪或其他运动/方向传感器、网络连接及本地缓存/存储能力，以录制、缓存、保存和上传任务数据。

我们将您按照任务指引录制、上传并经后续质检、筛选、标注、整理或其他数据处理后形成的数据，称为“采集成果”。采集成果主要用于完成您所参与的采集项目、进行数据质检、向您反馈采集质量、改进采集流程、开展产品研发和算法/模型训练相关的数据分析，以及在必要范围内向项目相关方交付。

为降低对个人权益的影响，我们会尽量将采集成果与您的账号、身份信息、联系方式等直接识别信息进行分离，并通过去标识化、匿名化或其他安全措施进行管理。后续在开展数据分析、产品研发、模型训练、数据产品化或项目交付时，我们原则上以不直接识别特定采集人员或其他自然人的方式处理采集成果；但如采集成果本身包含或结合其他信息后能够识别特定自然人，相关信息仍可能构成个人信息，我们将按照本政策及适用法律法规的要求进行处理。

请您注意，任务录像、录音或作业场景中可能包含您或其他自然人的人像、声音、行为动作、工作环境等信息。请您按照任务指引进行采集，并避免录入与采集任务无关的个人信息或敏感个人信息。如任务场景不可避免地涉及他人个人信息，您应按照任务指引或项目要求事先确保已取得相关人员的必要授权同意，或确认存在其他合法处理依据，并遵守项目现场的告知、遮挡、脱敏等要求。

（四）设备信息、系统权限和运行日志

为保障 Potentia Field 正常运行、完成数据采集和上传、进行故障诊断及安全管理，我们可能会收集您的设备信息和运行日志，包括设备型号、操作系统版本、App 版本、设备标识符或设备 SN、设备剩余存储/内存占用情况、网络状态、IP 地址、登录和访问时间、操作日志、上传日志、错误日志、崩溃日志、最近运行日志及您主动提交的问题类型和问题描述。

当您使用采集、上传、问题反馈等功能时，本App可能需要取得摄像头/相机权限、麦克风权限、运动与方向传感器或陀螺仪权限、网络权限以及本地缓存/存储相关权限。如您拒绝授予必要权限，可能无法使用对应的数据采集、录制、上传或故障反馈功能，但不影响您使用不依赖该等权限的其他功能。

如未来我们为任务区域识别、防作弊、任务匹配或安全管理目的启用粗略定位功能，我们可能会在取得您的授权后收集粗略位置信息（精度大于100米）。如您拒绝授权，我们可能无法为您提供依赖位置的任务分配、区域校验或安全管理功能。

（五）任务质量反馈、采集表现统计和项目管理信息

为进行任务质检、采集质量提升和项目管理，我们可能会收集或生成您的采集表现统计信息和质量反馈信息，包括总采集片段数、有效片段数、无效片段数、总采集时长、有效采集时长、有效率、上传数量、任务完成进度、质检结论、质检员反馈、问题标签、返工记录、异常记录及与采集质量相关的统计级或阈值信息。

我们使用上述信息用于向您展示当日或阶段性任务表现、向您反馈采集质量、支持质检员或项目管理员进行项目管理、识别并处理无效或异常片段、改进采集任务设计及提升整体数据质量。如相关统计或阈值信息被用于对您产生重要影响的自动化决策，我们将按照适用法律法规的要求向您提供解释和救济渠道。

（六）开发数据分析和研究，改进我们的产品或服务

为设计新产品、新服务，或改善我们现有产品和服务，我们可能会对您的账号信息、设备信息、诊断和用量数据、任务数据、采集质量统计信息进行分析和研究。我们将遵循最小必要原则，并在可行范围内对相关信息进行去标识化、匿名化或采取其他安全保护措施。

当我们要将您的个人信息用于本政策未载明的其他用途时，或者当我们要将基于特定目的收集而来的个人信息用于其他目的时，我们会依法另行向您告知并征得您的同意。

（七）依法无需取得授权同意的情形

您充分知晓，在以下情形，我们处理您的个人信息无需取得您的授权同意：

1. 为订立、履行您作为一方当事人的合同所必需，或者按照依法制定的劳动规章制度和依法签订的集体合同实施人力资源管理所必需；
2. 为履行法定职责或者法定义务所必需；
3. 为应对突发公共卫生事件，或者紧急情况下为保护自然人的生命健康和财产安全所必需；
4. 为公共利益实施新闻报道、舆论监督等行为，在合理范围内处理个人信息；
5. 依照法律规定在合理范围内处理您自行公开或者其他已经合法公开的个人信息；
6. 法律、行政法规规定的其他情形。

您的个人信息中可能含有敏感个人信息。我们会仅在具有特定目的和充分必要性，并采取严格保护措施的情形下处理您的敏感个人信息；法律法规要求取得单独同意的，我们将依法取得您的单独同意。

二、我们如何使用 Cookie 和同类技术

为确保网站、管理后台、服务端页面或相关网页功能正常运转，我们可能会在您的计算机或移动设备上存储名为 Cookie 的小数据文件。Cookie 通常包含标识符、站点名称以及一些号码和字符。我们仅会根据您所授权同意的范围处理关于您的 Cookie。

除 Cookie 外，我们还可能会在网站或相关网页服务中使用网站信标、像素标签或其他同类技术，用于了解服务使用情况、保障登录状态和改进服务体验。如果您不希望自己的活动以这种方式被追踪，可以通过浏览器设置或我们提供的方式进行管理。

三、我们如何使用 SDK

为提供和优化我们的服务，我们的产品中可能内嵌第三方 SDK 或接入第三方技术服务。这些第三方 SDK 或技术服务在配合我们向您提供服务的同时，可能会收集您的个人信息。我们将采取必要方式控制该等第三方 SDK 或技术服务对您个人信息的收集与使用，确保您的个人信息得到有效保护。关于第三方的身份、收集目的以及第三方隐私政策链接等，请详见本政策附件一第三方 SDK/第三方技术服务说明。

四、我们如何共享、转让、公开披露您的个人信息

（一）共享

我们不会与上海补天石科技有限公司以外的任何第三方公司、组织和个人共享您的个人信息，但以下情况除外：

1. 在获取明确同意的情况下共享：获得您的明确同意后，我们会与其他方共享您的个人信息；
2. 根据法律法规规定，或按照政府主管部门的强制性要求，对外共享您的个人信息；
3. 与授权合作伙伴共享：仅为实现本政策中声明的目的，我们的某些服务可能由授权合作伙伴提供。我们可能会与云服务商、数据存储服务商、IT运维服务商、安全服务商、SDK/技术服务提供商、供应商管理员、质检员、项目客户或其他项目相关方共享必要的个人信息；并在账号管理、任务下发、数据采集、数据质检、项目交付、系统运维和安全管理所必需的范围内，提供任务数据或采集成果。我们会尽量以不直接识别特定自然人的方式提供采集成果；如相关任务数据或采集成果仍包含个人信息，我们将按照本政策及适用法律法规处理。我们仅会出于合法、正当、必要、特定、明确的目的共享您的个人信息，并且只会共享提供服务所必要的个人信息。我们的合作伙伴无权将共享的个人信息用于任何其他用途；
4. 与关联方共享：为便于我们基于统一的账号体系、技术支持、安全管理或项目管理向您提供服务，我们可能会在必要范围内与我们的关联方共享您的个人信息。我们会要求关联方按照本政策以及不低于本政策的保护标准处理您的个人信息。

对于授权合作伙伴，我们会与其签署严格的保密协议或数据处理协议，要求他们按照我们的说明、本隐私权政策以及其他相关的保密和安全措施处理个人信息。

（二）转让

我们不会将您的个人信息转让给任何公司、组织和个人，但以下情况除外：

1. 在获取明确同意的情况下转让：获得您的明确同意后，我们会向其他方转让您的个人信息；
2. 在涉及合并、分立、解散、被宣告破产、业务转让、资产转让或类似交易时，如涉及个人信息转让，我们会向您告知接收方的名称或者姓名和联系方式，并要求新的接收方继续受本隐私权政策的约束；如接收方变更原先的处理目的、处理方式，我们将要求接收方重新取得您的同意。

（三）公开披露

我们仅会在以下情况下公开披露您的个人信息：

1. 获得您的单独同意后；
2. 基于法律、法律程序、诉讼或政府主管部门强制性要求，我们可能会公开披露您的个人信息。

五、我们如何保护您的个人信息

1. 我们已使用符合业界标准的安全防护措施保护您提供的个人信息，防止数据遭到未经授权访问、公开披露、使用、修改、损坏或丢失。例如，我们会使用加密技术、访问控制机制、日志审计机制、权限分级机制和安全培训机制保护个人信息安全。
2. 我们会采取一切合理可行的措施，确保未收集无关的个人信息。我们只会在达成本政策所述目的所需的期限内保留您的个人信息，除非需要延长保留期或受到法律法规允许。
3. 我们采取严格的数据使用和访问制度，确保只有授权人员才可访问您的个人信息，并适时对数据和技术进行安全审计，同时定期对授权人员进行安全教育和培训。
4. 我们将制定并组织个人信息安全事件应急预案，并在发生个人信息安全事件时立即启动应急预案，努力控制安全事件的影响。发生或可能发生个人信息安全事件的，我们将按照法律法规要求及时向您告知相关情况，并主动向监管部门报告个人信息安全事件处置情况。
5. 请您理解，由于技术限制以及可能存在的各种恶意手段，即便我们竭尽所能加强安全措施，也不可能始终保证信息百分之百安全。您应妥善保管账号、密码、验证码和设备，并避免将相关信息透露给他人。
6. 在您终止使用某项服务后，我们会停止对您个人信息的收集和使用，法律法规或监管部门另有规定的除外。如我们停止运营，将及时停止收集您个人信息，并以逐一送达或公告形式通知您，对我们所持有的您的个人信息进行删除或匿名化处理。

六、您的个人信息权利

按照中国相关法律、法规、标准，我们保障您对自己的个人信息行使以下权利：

（一）访问或复制您的个人信息

您有权根据法律法规的规定访问或复制您的个人信息。如果您希望访问或复制您的账号信息、采集任务信息或其他个人信息，可以通过 Potentia Field 中的相关页面执行此类操作；如无法通过上述方式访问或复制，您可以通过本政策“如何联系我们”列明的方式与我们联系。

（二）补充或更正您的个人信息

当您发现我们处理的关于您的个人信息不准确或不完整时，您有权要求我们补充或更正。您可以通过 Potentia Field 中的相关页面操作，或通过本政策“如何联系我们”列明的方式与我们联系。

（三）删除您的个人信息

在以下情形中，您可以向我们提出删除个人信息的请求：

1. 处理目的已实现、无法实现或者为实现处理目的不再必要；
2. 我们停止提供产品或服务，或者保存期限已届满；
3. 您撤回同意；
4. 我们违反法律、行政法规或者违反约定处理个人信息；
5. 法律、行政法规规定的其他情形。

若我们决定响应您的删除请求，我们还将同时通知从我们获得您的个人信息的实体，要求其及时删除，除非法律法规另有规定，或这些实体获得您的独立授权。

当您或我们协助您删除相关信息后，因为适用法律和安全技术，我们可能无法立即从备份系统中删除相应信息，我们将安全地存储您的个人信息并将其与任何进一步处理隔离，直到备份可以清除或实现匿名。

（四）改变您授权同意的范围

每个业务功能需要一些基本个人信息才能完成。对于额外收集的个人信息，您可以随时给予或收回您的授权同意。您可以通过系统设置、设备权限设置或本政策“如何联系我们”列明的方式管理您的授权同意。

当您收回同意后，我们将不再处理相应的个人信息。但您收回同意的决定，不会影响此前基于您的授权而开展的个人信息处理。

（五）注销账户

您可以通过本政策“如何联系我们”列明的方式申请注销此前注册的账户。在注销账户之后，我们将停止为您提供产品或服务，并依据您的要求删除您的个人信息，法律法规另有规定的除外。

（六）约束信息系统自动决策

在某些业务功能中，我们可能依据信息系统、算法等在内的自动化决策机制作出决定。如果这些决定对您的权益产生重大影响，您有权要求我们作出解释，并有权拒绝我们仅通过自动化决策方式作出决定。

（七）响应您的上述请求

为保障安全，您可能需要提供书面请求，或以其他方式证明您的身份。我们可能会先要求您验证自己的身份，然后再处理您的请求。我们将在法律法规规定的期限内响应您的请求。

如您不满意，还可以向网信、电信、公安及市场监督管理等监管部门进行投诉或举报。

对于您合理的请求，我们原则上不收取费用；但对多次重复、超出合理限度的请求，我们可能视情收取一定成本费用。对于无端重复、需要过多技术手段、给他人合法权益带来风险或者非常不切实际的请求，我们可能会依法予以拒绝。

在以下情形中，按照法律法规要求，我们将无法响应您的上述请求：

1. 与我们履行法律法规规定的义务相关的；
2. 与国家安全、国防安全直接相关的；
3. 与公共安全、公共卫生、重大公共利益直接相关的；
4. 与犯罪侦查、起诉、审判和判决执行等直接相关的；
5. 有充分证据表明您存在主观恶意或滥用权利的；
6. 响应您的请求将导致您或其他个人、组织的合法权益受到严重损害的；
7. 涉及商业秘密的；
8. 法律、行政法规规定的其他情形。

七、您的个人信息如何在全球范围转移

原则上，我们在中华人民共和国境内收集和产生的个人信息，将存储在中华人民共和国境内。目前，我们理解 Potentia Field 中国境内版本本身涉及的账号信息、设备信息、运行日志、采集表现统计等个人信息存储于中国境内的腾讯云，App 运行层面的个人信息处理原则上不涉及向境外提供个人信息。

如未来因跨境质检、境外客户交付、境外技术支持、集团内部协作或其他业务需要，导致我们需要将中华人民共和国境内收集和产生的个人信息提供至境外，我们将严格依照适用法律法规执行。

八、您的个人信息存储期限

通常情况下，我们仅为实现您授权使用的目的所必需的最短时间保留您的个人信息，除非法律法规另有规定或者获得您的另行授权同意。

账户信息通常将在您的账号存续期间保留；采集任务运行中产生的个人信息、质检记录、采集表现统计和日志信息将在完成采集项目、质量确认、项目交付、争议处理、安全审计以及法律法规要求所需的期限内保留；采集成果及其经质检、筛选、标注、整理、去标识化、匿名化或其他处理后形成的数据产品/成果数据，将根据项目交付、产品研发、模型训练、质量追溯、争议处理及法律法规要求所需的期限保留；对于其中仍构成个人信息的部分，我们将遵循最小必要原则确定保存期限，并在超出个人信息存储期限后进行删除或匿名化处理。

在符合上述原则的前提下，我们目前对各类个人信息适用以下保存期限：

采集成果或其他数据经匿名化处理，已无法识别特定自然人且不能复原的，不属于个人信息，不适用上表所列保存期限。我们可继续保留并将其用于产品研发、算法/模型训练、数据产品化、项目交付及本政策所述的其他目的。我们将结合相关数据的性质以及重新识别所需的合理手段，评估匿名化是否已实际实现；如相关数据仍可通过账号、任务记录、质检记录或其他信息重新识别到特定个人，我们将继续将其作为个人信息处理。

九、我们如何保护未成年人的信息

我们关注且重视未成年人权益的保障。Potentia Field 不面向未满十八周岁的未成年人提供服务。如果我们发现收集了未成年人的个人信息，我们将会尽快采取措施删除相关信息及文件。此外，如果您不具有完全民事行为能力，请在法定监护人的同意下使用我们的服务或向我们提供您的信息。

十、本政策如何更新

我们的隐私权政策将不时变更。我们会在本页面或 Potentia Field 中发布对本政策所作的任何变更。对于重大变更情形，我们还会提供更为显著的通知。

本政策所指的重大变更包括但不限于：

1. 我们的服务模式发生重大变化，如处理个人信息的目的、处理的个人信息类型、个人信息的使用方式发生变化；
2. 个人信息共享、转让或公开披露的主要对象发生变化；
3. 您参与个人信息处理方面的权利及其行使方式发生重大变化；
4. 数据安全能力、信息安全风险发生变化；
5. 其他可能对您的个人信息权益产生重大影响的变化。

如您在本政策更新生效后继续使用 Potentia Field，即表示您已充分阅读、理解并接受更新后的政策并愿意受更新后的政策约束。

十一、如何联系我们

如果您对本隐私权政策有任何疑问、意见或建议，可以通过以下方式联系我们：

电子邮件：privacy@potentia.ai

联系地址：上海市中国（上海）自由贸易试验区环科路999弄1号3层

如果您对我们的回复不满意，特别是我们的个人信息处理行为损害了您的合法权益，您还可以向网信等监管部门进行投诉或举报。

附件一 第三方 SDK/第三方技术服务说明

为提供和优化我们的服务，我们的产品中可能内嵌第三方 SDK 或接入第三方技术服务。这些第三方 SDK 或技术服务在配合我们向您提供服务的同时，可能会收集您的个人信息。如您对第三方通过 SDK 或技术服务收集您的个人信息有所疑问的，请参见该第三方的隐私政策。

截至本政策更新之日，我们未在 Potentia Field 中接入会收集个人信息的第三方 SDK 或第三方技术服务。如我们未来接入此类第三方 SDK 或第三方技术服务，我们将更新本附件，并在相关功能上线前按照法律法规要求向您告知并征得您的同意。

Privacy Policy

Last Updated: July 16, 2026

Overview

Shanghai Butianshi Technology Co., Ltd (上海补天石科技有限公司) ("we", "us" or "our") respects and protects users' Personal Data. This Privacy Policy (this "Policy" or "Privacy Notice") applies to the Potentia Field App ("Potentia Field" or the "App") and related services that we provide to users in Malaysia.

This Policy explains the following:

1. the Personal Data we collect and how we use it;
2. how we use Cookies and similar technologies;
3. how we use SDKs or third-party technical services;
4. how we disclose, transfer and publicly disclose your Personal Data;
5. how we protect your Personal Data;
6. your rights in relation to Personal Data;
7. how your Personal Data may be transferred globally;
8. how long we retain your Personal Data;
9. how we protect minors;
10. how this Policy may be updated; and
11. how you may contact us.

We understand the importance of Personal Data to you and will use our best efforts to keep your Personal Data secure and reliable. We are committed to maintaining your trust and will take appropriate security measures to protect your Personal Data in accordance with applicable laws and mature industry security standards. Please read and understand this Policy carefully before using our products or services.

1. How We Collect and Use Your Personal Data

For the purposes of this Policy, "Personal Data" means any information in respect of commercial transactions that relates directly or indirectly to an identified or identifiable natural person, and includes any sensitive personal data under applicable Malaysian law. Personal Data does not include data that has been anonymized so that it no longer identifies an individual.

We may collect Personal Data directly from you, from your team administrator or supplier administrator, from your device or your use of Potentia Field, and from inspectors, project administrators or other authorized users who provide task feedback or project management information.

Unless we state otherwise, the Personal Data and device permissions required for account creation, identity verification, task allocation, recording, caching, uploading, quality feedback, system security and technical support are obligatory for the relevant functions. If you do not provide the required Personal Data or permissions, you may not be able to create or use your account, receive or claim tasks, record or upload task data, receive feedback, or use the corresponding App features. Personal Data collected for optional or future features, such as approximate location, will be voluntary and subject to your authorization where required.

1.1 Registering, Logging in to Potentia Field and Enabling Collection Permissions

To complete account creation, login, identity verification and collection permission configuration, you may need to provide, or your team administrator/supplier administrator may provide or configure for you, the following information: username, login account, either an email address or a mobile phone number (you may choose which one to provide), password, invitation code, team or supplier, and role/permission information. We use this information to create and manage your Potentia Field account, verify your login identity, confirm whether you are an invited collector or internal project personnel, and configure corresponding collection task permissions for you.

Potentia Field is currently used by invitation only. Account registration requires an invitation code, and you provide either an email address or a mobile phone number, at your choice, as the identifier for your account. We use this identifier to create and identify your account, secure your account, enable account recovery, send you notifications relating to your account and collection tasks, and detect and prevent duplicate or fraudulent registration. To prevent duplicate registration, we check whether the email address or mobile phone number you provide has already been registered, and we may retain the relevant identifier, or an irreversibly encrypted form of it, after your account is closed, solely for this purpose. We do not currently send verification codes to your email address or mobile phone number, and we do not currently verify that the identifier you provide belongs to you. We do not currently carry out real-name or identity authentication, and we do not currently process settlement or payment through Potentia Field. If we introduce email or SMS verification, crowdsource collector registration, real-name or identity authentication, settlement functions or other account authentication methods in the future, we may collect additional Personal Data, including verification codes and verification status, and may engage third-party service providers to deliver such messages. We will update this Policy and obtain your consent in accordance with applicable laws before such functions are launched.

1.2 Viewing, Claiming and Performing Collection Tasks

When you view, search, filter, claim or perform collection tasks, we may collect and generate task-related information, including project/task name, task type, task guide, demo video, batch information, claimed quantity, task status, collection progress, upload status, task completion time, task feedback and operation records associated with your account. We use this information to display collection tasks to you, support your claiming and completion of collection tasks, record task performance status, manage tasks and trace quality.

1.3 Collecting, Saving and Uploading Task Data

Potentia Field is a mobile App for collecting task data. When you start collecting according to task requirements, the App may call your camera, microphone, gyroscope or other motion/orientation sensors, network connection and local cache/storage capabilities to record, cache, save and upload task data.

We refer to the data that you record and upload according to the task guide, and that is subsequently inspected, screened, annotated, organized or otherwise processed, as "Collection Outputs". Collection Outputs are primarily used to complete the collection project in which you participate, perform data quality inspection, provide feedback to you on collection quality, improve collection workflows, conduct product research and data analysis related to algorithm/model training, and deliver to project-related parties within the necessary scope.

To reduce the impact on individual rights and interests, we will endeavor to separate Collection Outputs from direct identifiers such as your account, identity information and contact details, and manage them through de-identification, anonymization or other security measures. When we conduct data analysis, product research, model training, data productization or project delivery, we generally process Collection Outputs in a manner that does not directly identify a particular collector or other natural person. However, if Collection Outputs themselves identify, or can be combined with other information to identify, a specific individual, the relevant information may still constitute Personal Data and will be processed in accordance with this Policy and applicable laws.

Please note that task videos, audio recordings and work scenes may contain images, voices, body movements, work environments or other information relating to you or other individuals. Please follow the task guide and avoid recording Personal Data or sensitive Personal Data that is unrelated to the collection task. If the task scene inevitably involves the Personal Data of other individuals, you should, in accordance with the task guide or project requirements, ensure that the necessary authorization/consent has been obtained from those individuals, or confirm that another lawful basis for processing exists, and comply with any on-site notice, masking, blurring, minimization or other requirements.

1.4 Device Information, System Permissions and Operating Logs

To ensure the normal operation of Potentia Field, complete data collection and upload, diagnose faults and manage security, we may collect your device information and operating logs, including device model, operating system version, App version, device identifier or device SN, remaining device storage/memory usage, network status, IP address, login and access time, operation logs, upload logs, error logs, crash logs, recent operating logs, and issue type and issue description that you voluntarily submit.

When you use collection, upload and issue-reporting functions, the App may need to obtain camera permission, microphone permission, motion and orientation sensor or gyroscope permission, network permission and local cache/storage-related permissions. If you refuse to grant necessary permissions, you may not be able to use the corresponding data collection, recording, upload or fault feedback functions, but this will not affect your use of other functions that do not depend on such permissions.

If, in the future, we enable approximate location for task-region identification, anti-fraud, task matching or security management purposes, we may collect approximate location information (with an accuracy greater than 100 meters) after obtaining your authorization. If you refuse authorization, we may not be able to provide task allocation, regional verification or security management functions that depend on location.

1.5 Task Quality Feedback, Collector Performance Statistics and Project Management Information

For task quality inspection, collection quality improvement and project management, we may collect or generate your collector performance statistics and quality feedback information, including total number of clips, valid clips, invalid clips, total collection duration, valid collection duration, valid rate, upload quantity, task completion progress, inspection results, inspector feedback, issue tags, rework records, abnormality records, and statistical or threshold information relating to collection quality.

We use this information to show your daily or periodic task performance, provide feedback to you on collection quality, support inspectors or project administrators in project management, identify and handle invalid or abnormal clips, improve collection task design and enhance overall data quality. If any statistical or threshold information is used for automated decision-making that has a significant impact on you, we will provide explanations and relief channels as required by applicable law.

1.6 Research, Analysis and Improvement of Our Products or Services

To design new products or services, or improve our existing products and services, we may analyze and research your account information, device information, diagnostic and usage data, task data and collection quality statistics. We will follow the data minimization principle and, where practicable, de-identify, anonymize or otherwise protect the relevant information.

When we intend to use your Personal Data for purposes not described in this Policy, or when we intend to use Personal Data collected for a specific purpose for another purpose, we will provide additional notice and obtain your consent where required by applicable law.

1.7 Circumstances Where Consent May Not Be Required

You understand that, under applicable law, we may process your Personal Data without obtaining your consent in certain circumstances, including where processing is necessary for the performance of a contract with you, compliance with legal obligations, protection of vital interests, administration of justice, exercise of functions conferred by law, or other circumstances permitted by applicable laws.

Your Personal Data may include sensitive personal data. We will process sensitive personal data only where there is a specific purpose and sufficient necessity and where strict protection measures are adopted. Where applicable law requires explicit consent, we will obtain your explicit consent.

2. How We Use Cookies and Similar Technologies

To ensure that websites, management consoles, server-side pages or related web functions operate properly, we may store small data files called Cookies on your computer or mobile device. Cookies usually contain identifiers, site names and certain numbers and characters. We will process Cookies only within the scope of your authorization/consent where required.

In addition to Cookies, we may use web beacons, pixel tags or other similar technologies on websites or related web services to understand service usage, maintain login status and improve service experience. If you do not want your activities to be tracked in this way, you may manage these technologies through your browser settings or other methods we provide.

3. How We Use SDKs or Third-Party Technical Services

To provide and optimize our services, our products may integrate third-party SDKs or connect to third-party technical services. These SDKs or technical services may collect Personal Data while supporting us in providing services. We will take necessary measures to control the collection and use of your Personal Data by such SDKs or technical services and protect your Personal Data effectively. For the identities of third parties, purposes of collection and third-party privacy notice links, please see Appendix 1 Third-Party SDKs / Third-Party Technical Services.

4. How We Disclose, Transfer and Publicly Disclose Your Personal Data

4.1 Disclosure

We will not disclose your Personal Data to any third-party company, organization or individual outside Shanghai Butianshi Technology Co., Ltd, except in the following circumstances:

1. Disclosure with consent: after obtaining your consent where required, we may disclose your Personal Data to other parties;
2. Disclosure required by laws or authorities: we may disclose your Personal Data in accordance with laws and regulations or mandatory requirements of competent governmental authorities;
3. Authorized partners: solely for the purposes described in this Policy, certain services may be provided by authorized partners. We may disclose necessary Personal Data to cloud service providers, data storage service providers, IT operation and maintenance service providers, security service providers, SDK/technical service providers, supplier administrators, inspectors, project customers or other project-related parties; and, within the scope necessary for account management, task distribution, data collection, data quality inspection, project delivery, system operation and security management, provide task data or Collection Outputs. We will endeavor to provide Collection Outputs in a manner that does not directly identify a specific individual; where the relevant task data or Collection Outputs still contain Personal Data, we will process and disclose them in accordance with this Policy and applicable law;
4. Affiliates: to provide services based on a unified account system, technical support, security management or project management, we may disclose your Personal Data to our affiliates within the necessary scope. We will require affiliates to process your Personal Data in accordance with this Policy and protection standards no lower than those described in this Policy.

We will require authorized partners to process Personal Data pursuant to confidentiality agreements, data processing agreements or other contractual arrangements, and to process Personal Data in accordance with our instructions, this Policy and other relevant confidentiality and security measures.

4.2 Transfer

We will not transfer your Personal Data to any company, organization or individual, except where we obtain your consent where required, or where a transfer occurs in connection with a merger, division, dissolution, bankruptcy, business transfer, asset transfer or similar transaction. If such transfer involves Personal Data, we will notify you of the recipient's name and contact details where required by applicable law and require the new recipient to continue to be bound by this Policy. If the recipient changes the original processing purposes or methods, it must obtain your consent where required by applicable law.

4.3 Public Disclosure

We will only publicly disclose your Personal Data after obtaining your explicit consent where required, or where disclosure is required by laws, legal procedures, litigation or competent governmental authorities.

5. How We Protect Your Personal Data

1. We use security safeguards designed to protect Personal Data against unauthorized access, public disclosure, use, modification, damage or loss. These measures may include encryption, access controls, logging and audit mechanisms, role-based permissions and security training.
2. We take all reasonable and practicable steps to ensure that irrelevant Personal Data is not collected. We retain your Personal Data only for the period necessary to achieve the purposes described in this Policy, unless a longer retention period is required or permitted by laws and regulations.
3. We maintain strict data access and usage controls so that only authorized personnel may access your Personal Data, and we conduct data and technical security audits and provide security training to authorized personnel where appropriate.
4. We will maintain and implement personal data security incident response procedures. Where a Personal Data security incident occurs or may occur, we will take steps to control the impact and notify you and/or competent authorities as required by applicable law.
5. Please understand that, due to technical limitations and possible malicious activities, no security measures can guarantee absolute security. You should properly safeguard your account, password, verification codes and devices and avoid disclosing them to others.
6. If you stop using a service, we will stop collecting and using your Personal Data for that service, unless otherwise required by laws or regulators. If we cease operations, we will stop collecting your Personal Data in a timely manner, notify you by individual notice or public announcement where required, and delete or anonymize the Personal Data we hold.

6. Your Personal Data Rights

Subject to applicable Malaysian law, you may have the right to request access to and correction of your Personal Data, withdraw consent, limit the processing of Personal Data, close your account, object to certain processing activities, and exercise other rights available under applicable data protection law.

You may access or correct certain account information through Potentia Field where such functions are available. If you cannot exercise your rights through the App, or if you wish to submit a request, you may contact us using the contact details in the "Contact Us" section of this Policy. To protect your Personal Data, we may need to verify your identity before responding to your request.

If you withdraw consent or ask us to limit or stop certain processing, we will apply your request prospectively to the extent required by applicable law. However, this will not affect processing already conducted before withdrawal, nor processing that we are required or permitted to continue under applicable law. If you refuse to provide mandatory Personal Data or withdraw consent necessary for a function, we may be unable to provide the corresponding feature or service.

If you are dissatisfied with our response, you may lodge a complaint with the Personal Data Protection Commissioner of Malaysia or other competent authority, where applicable.

7. How Your Personal Data May Be Transferred Globally

Personal Data collected through Potentia Field is stored on cloud infrastructure located in Malaysia. However, storage in Malaysia does not mean that your Personal Data is accessed only from within Malaysia. This section explains where your Personal Data may be transferred to, or accessed from, outside Malaysia.

We are a company incorporated in China, and members of our personnel, technical teams and affiliates located in China access Personal Data stored in Malaysia in order to operate and maintain Potentia Field, administer accounts and collection tasks, carry out data quality inspection, provide technical support and fault diagnosis, and perform security management. Such access includes account information, task information and operation records, device information and operating logs, task quality feedback and collector performance statistics, and task data and Collection Outputs. Remote access to Personal Data from outside Malaysia constitutes a transfer of Personal Data outside Malaysia. Accordingly, your Personal Data is transferred to, and processed in, China.

We will transfer Personal Data outside Malaysia only in accordance with the Malaysia Personal Data Protection Act 2010 and other applicable requirements, and we will apply appropriate safeguards to such transfers, including contractual arrangements with the recipients, access controls limiting access to authorized personnel, and the security measures described in this Policy.

Depending on project arrangements, task data, Collection Outputs or project data may, after quality inspection, screening, annotation, organization, de-identification, anonymization or other processing, be used for product research, algorithm/model training, data productization, project delivery, customer acceptance, technical support or internal collaboration. Such data may be accessed, used or delivered to project-related parties located outside Malaysia. If the relevant Collection Outputs, project data or other information constitute Personal Data, we will transfer such Personal Data outside Malaysia only in accordance with the Malaysia Personal Data Protection Act 2010 and other applicable requirements.

8. How Long We Retain Your Personal Data

We will retain Personal Data only for the shortest period necessary to fulfill the purposes described in this Policy, unless a longer retention period is required by law or separately authorized by you.

Account information will generally be retained while your account remains active. Task information, Collection Outputs, quality feedback, operating logs and security audit logs will be retained for the period necessary for project performance, quality confirmation, project delivery, dispute handling, security audit and compliance with legal requirements. For any portion that still constitutes Personal Data, we will determine the retention period under the data minimization principle and delete or anonymize it after the retention period expires.

Subject to the foregoing, we currently apply the following retention periods to each category of Personal Data:

Where Collection Outputs or other data have been anonymized so that they no longer identify, and cannot be used to re-identify, a particular collector or other natural person, such data no longer constitutes Personal Data and the retention periods set out above do not apply to it. We may continue to retain and use such anonymized data for product research, algorithm/model training, data productization, project delivery and other purposes described in this Policy. We will assess whether anonymization has been effectively achieved, taking into account the nature of the relevant data and the means reasonably likely to be used for re-identification; where data can be re-identified by reference to an account, task record, quality inspection record or other information, we will continue to treat it as Personal Data.

9. How We Protect Minors

Potentia Field is not intended for individuals under the age of 18. If we discover that we have collected Personal Data from a minor without appropriate consent or authorization, we will take steps to delete the relevant information as soon as practicable. If you do not have full legal capacity, please use our services or provide your information only with the consent of your legal guardian.

10. How This Policy May Be Updated

We may update this Policy from time to time. We will publish updates on the relevant page or in Potentia Field. For material changes, we may provide more prominent notice where required by law. Material changes may include major changes to our service model, the purposes of processing Personal Data, the types of Personal Data processed, the way we use Personal Data, the main recipients of Personal Data, your rights and how you exercise them, or data security risks.

If you continue to use Potentia Field after an updated Policy takes effect, you will be deemed to have read, understood and accepted the updated Policy to the extent permitted by applicable law.

11. How You May Contact Us

If you have any questions, comments or requests regarding this Policy or our processing of Personal Data, please contact us at:

Email: privacy@potentia.ai

Address: 3rd Floor, No. 1, Lane 999, Huanke Road, China (Shanghai) Pilot Free Trade Zone, Shanghai 200000, China

Appendix 1 Third-Party SDKs / Third-Party Technical Services

To provide and optimize Potentia Field, the App may access third-party SDKs or third-party technical services. Such SDKs or services may collect Personal Data while supporting App features. If you have questions about how a third party collects or processes Personal Data through an SDK or technical service, please refer to the relevant third party privacy notice.

As at the date of this Policy, we have not integrated any third-party SDK into Potentia Field that collects Personal Data. If we integrate any such third-party SDK or third-party technical service in the future, we will update this Appendix and, where required by applicable law, provide notice to you and obtain your consent before the relevant function is launched.