This policy explains how LET ME LLC ("we", "us") handles personal information in connection with Canton Check (the "Service"). It covers two groups of people:
- Users: people who visit the website, run checks, create an account or use the API.
- People named in reports: individuals whose information appears in public records about Chinese companies, such as legal representatives, shareholders and executives.
You can make any privacy request, including access, correction, deletion and objection, through our contact form at /contact. Choose the request type that fits.
1. Information we collect about users
| What | Examples | How we get it |
|---|---|---|
| Account information | Email address. Your password is stored only in hashed form by our authentication provider. If you sign in with Google: your Google account email and basic profile. | You provide it |
| Searches and reports | Supplier names, registration numbers or store links you search; the checks and reports you run; suppliers you track; API keys you create (we store only a hash of each key) | You provide it, and the Service generates it |
| Technical information | Your IP address, which we store only as a one-way hash to enforce free-usage limits and prevent abuse; browser and device information; error logs | Collected automatically |
| Analytics (only with your consent) | How you use pages: clicks, scrolls and session recordings, collected by Microsoft Clarity. Clarity loads only after you accept analytics in the cookie banner. | Collected automatically, after consent |
| Messages | Correction reports, privacy requests and other messages you send through our forms, plus an optional email address if you give one | You provide it |
| Local browser storage | Your remaining free checks, recently viewed reports, tracked suppliers and your cookie choice. This is stored in your browser's local storage, not on our servers. | Your browser |
We do not knowingly collect information from children, and the Service is intended for business use by adults.
2. How we use user information
| Purpose | Legal basis (where GDPR or similar laws apply) |
|---|---|
| Provide the Service: run searches and checks, show reports, keep your history, operate accounts and API keys | Performance of our contract with you |
| Enforce free allowances and usage limits, prevent abuse and keep the Service secure | Legitimate interests (preventing misuse and protecting the Service) |
| Cache search and report results so repeat checks of the same company are faster and cheaper | Legitimate interests |
| Respond to your messages and requests | Contract, or legitimate interests |
| Understand and improve how the website is used (Microsoft Clarity) | Consent, which you can withdraw at any time via "Cookie settings" in the footer |
| Comply with law and enforce our Terms | Legal obligation, or legitimate interests |
We do not sell your personal information, and we do not use it for third-party advertising.
3. People named in reports
What we process: reports about Chinese companies can include the names of legal representatives, shareholders who are individuals, executives and other officers. They can also include business contact details that companies publish in their annual reports, and court, enforcement and penalty records concerning the company. Names may be shown in Chinese with a pinyin rendering or machine translation.
Where it comes from: information that companies in mainland China and Hong Kong publish or are required to disclose, such as company registration and annual-report records, court and enforcement publications and stock-exchange filings. We retrieve it through third-party business-information services and data-collection providers; see /data-sources. We are not affiliated with any government agency.
Why: to let businesses carry out due diligence on suppliers before entering into transactions with them.
Legal basis:
- Under China's Personal Information Protection Law (PIPL), we process personal information that has already been lawfully made public, within a reasonable scope connected to its original public purpose.
- Under GDPR and similar laws, we rely on legitimate interests: preventing fraud and supporting informed commercial decisions.
We do not intentionally process sensitive personal information about these individuals.
Your rights: if you are named in a report, you can ask us to tell you what we hold about you, correct inaccurate information, or delete or restrict information, through /contact ("I'm named in a report"). We will review each request and respond within the time required by applicable law. We may keep information about a company where the law allows, for example where it is still publicly required to be disclosed, but we will correct errors.
4. Who we share information with
We share personal information only with the service providers that run the Service, under contracts that limit their use of it:
| Provider | Role | Data involved |
|---|---|---|
| Lovable (lovable.dev) | Application hosting and deployment, Google sign-in broker, AI gateway | All Service data, as host |
| Supabase | Database and user authentication | Account data, checks, reports, messages, hashed IPs |
| Cloudflare | Network delivery and security | IP addresses in transit |
| Apify | Runs data-collection jobs against the sources listed on /data-sources | Company names and identifiers you search; no account data |
| AI model providers via the Lovable AI gateway (currently Google Gemini and OpenAI) | Machine translation of Chinese report text; suggesting Chinese company names for English searches | Company names and registry text; no account data |
| Microsoft (Clarity) | Website analytics, only after consent | Usage data and session recordings |
| Sign-in with Google, if you choose it | Account email |
We may also disclose information:
- if the law or a valid legal process requires it,
- to protect rights, safety and security,
- to a successor in a merger, acquisition or sale of assets, which would remain subject to this policy.
5. Where information is stored and international transfers
The Service's database is hosted by Supabase in Ireland (AWS eu-west-1). Our providers may process data in the United States and other countries. Where we transfer personal information out of the EEA, UK or Switzerland, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, as offered by our providers.
Information about Chinese companies is collected from publicly accessible sources and processed on servers outside mainland China.
6. How long we keep information
- Account information: for as long as your account exists. After you ask us to delete your account, we delete or anonymise it within 30 days, except where the law requires us to keep it.
- Checks and reports: kept to provide your history, shareable report links and caching. Anonymous checks are linked only to a hashed IP address. You can ask us to delete checks linked to your account.
- Cached company data: search results are refreshed after 30 days, and full company profiles may be reused for up to 7 days.
- Messages and requests: kept for as long as needed to handle them, and up to 3 years for record-keeping.
- Analytics: retained by Microsoft Clarity according to its own settings, currently up to about 13 months for aggregated data and shorter for recordings.
7. Security
We use measures appropriate to the Service:
- encryption in transit,
- database access rules that keep internal tables server-only,
- hashed API keys and IP addresses,
- access controls on full reports,
- role-checked admin access.
No system is perfectly secure. See /security for details.
8. Your rights
Depending on where you live, you may have the right to:
- access your personal information and get a copy of it,
- correct it,
- delete it,
- restrict or object to its processing,
- port it to another service,
- withdraw consent.
You may also have the right to complain to your data-protection authority. To exercise any right, use /contact. We may need to verify your identity before acting on a request. We will not treat you differently for exercising your rights.
9. Cookies and local storage
- Strictly necessary: sign-in sessions and your cookie choice, stored in your browser's local storage. These are needed for the Service to work.
- Analytics (optional): Microsoft Clarity sets cookies and records usage only if you click "Accept". You can change your choice at any time via "Cookie settings" in the footer.
10. Changes
We will post updates to this page and change the effective date. If changes are material, we will also show a notice on the Service.
Contact
LET ME LLC, operator of Canton Check. For privacy requests and questions, use /contact.