Privacy Policy

Qiao - digital guide for international students in China

Effective date: 23 October 2026 · Version 1.4

1. Who we are

This Privacy Policy explains how Duor Digital OÜ ("Qiao", "we", "us"), a company registered in Estonia under registry code 17631584, with its registered office at Tartu mnt 67/1-13b, 10115 Tallinn, collects and uses personal data when you use the Qiao mobile application, the website myqiao.app, and related services (together, the "Service").

We are the data controller for the personal data described here.

• General and privacy enquiries: support@qiaoguide.com
• Support: support@qiaoguide.com

We are established in the European Union, so the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Estonian Personal Data Protection Act apply to our processing, wherever in the world you use the Service.

2. Short summary

3. What personal data we collect

3.1 Data you give us

3.2 Data created as you use the Service

3.3 Data we receive from others

• App stores - a purchase confirmation and, where you buy through them, a transaction identifier, including for a purchase a parent makes for you as a gift. Apple and Google do not give us your payment card details.
• Stripe - when you pay with Alipay on our payment page, Stripe confirms the payment and gives us its reference. We never receive your Alipay account details.
• Manual payments - when you, or someone you shared a payment link with, pay for Meet or a mobile data plan by following the instructions on the payment page, we see what the payment method shows a recipient, such as the payer's name, the amount and the reference.
• Partner agency - if you came through an agency, the agency may tell us that you are their student and the status of your application. An agency that placed you at a university may also confirm your admission for the cohort, either directly or by giving us a list of its admitted students with their email address or Telegram username, university and intake (see section 10). If your agency books an airport meeting for you, we receive the details it enters (section 15).
• Your helper - the steps they mark as done and when, the photos they add to those steps, the note of the route card, and the confirmation that you met.
• Other cohort members - introduction requests they send you and reports they make about you.
• Parents - a parent who subscribes to updates on the parent page gives us their email address and preferred language. A parent with a Qiao account who links to you with your code gives us that link, the payments they make for you and the asks they decline.
• Data plan provider - whether your mobile data plan is ready, installed or could not be made, its activation details and the last 4 digits of its SIM number.

3.4 What we do not collect

We do not collect biometric templates, health data, racial or ethnic origin, political opinions, religious beliefs, trade-union membership, sexual orientation, or criminal-offence data. The photo page of a passport you keep in Documents shows your face, but we do not create templates from it or use it to recognise you. If you volunteer such information in a message to the assistant, we process it only to answer you and delete it with the rest of your chat history when you delete it or your account.

4. How we use your data

1. To run the Service - create your account, generate your personal plan and checklist, calculate deadlines, store your documents, confirm your name, date of birth and sex from your passport or JW202, read your admission letter, answer your questions, show the map and phrasebook, run the cohort, arrange Meet, provide mobile data plans, show your progress to your parents, let a parent pay for you, run the agency chat, and pass requests for admission help to partner agencies.
2. To remind you - send notifications about deadlines you asked us to track, about your cohort introductions, Meet booking and study plan review, about parents who link to you and what they pay for you, and, around your arrival, about your next step; send updates to parents who asked for them.
3. To personalise - filter content by your city, university, role and arrival status, adapt the assistant's answers to your situation and language, and choose the next steps the app suggests to you.
4. To take payment - process purchases, including gifts from parents, confirm payments for Meet and mobile data plans, manage your Qiao Pass and wallet, keep accounting records.
5. To support you - answer your questions and investigate problems you report.
6. To keep the Service safe - detect abuse, prevent fraud, enforce limits, protect accounts, moderate the cohort and look into complaints about helpers.
7. To improve - understand which parts of the Service are used, measure the quality of answers, diagnose faults. Wherever possible we use aggregated or pseudonymised data for this.
8. To comply with the law - respond to lawful requests, keep tax and accounting records.

We do not use your data to train artificial-intelligence models, and we do not allow our providers to train their models on it.

We do not make decisions about you by purely automated means that produce legal effects or similarly significantly affect you. The assistant's answers, your generated plan, the next steps the app suggests and your scholarship-chances result are informational and do not decide anything on your behalf.

5. Advertising

We do not display advertising in the Service, we do not sell or share personal data for advertising, and we do not use advertising identifiers such as IDFA or the Android Advertising ID.

6. The AI assistant

When you send a message to the assistant:

• your message, your profile context (city, university, role, arrival status, your current stage such as applying or first month, the app's next steps that apply to you now such as booking Meet, level of Chinese, language, and coarse indications of your document deadlines such as "visa expires in about three weeks") and relevant extracts from our knowledge base are sent to OpenAI, L.L.C. to generate an answer;
• if you attach a photo, only the text recognised from it on your phone is sent with your message, and the assistant may suggest checklist tasks from it; the photo itself stays on your phone (see section 9);
• we do not send your email address, your name or your document numbers to OpenAI, unless they appear in a photo or a text you choose to send;
• OpenAI processes this on our behalf under a data-processing agreement and its API terms, and does not use it to train its models;
• answers may be cached so that identical questions can be answered instantly. Caches are keyed by a hash of your profile situation, not by your identity. Answers to questions with a photo are never cached;
• your conversation history is stored so you can return to it, and short-lived working copies are held for up to 30 days. Text recognised from a photo is kept with the conversation for 30 days and then deleted, and the assistant's working memory holds it for no more than 24 hours;
• if you rate an answer with a thumbs-up or thumbs-down, we store that rating with the message so we can improve quality.

Study plan review. If you order a review of your study plan or motivation letter, your text is sent to OpenAI to prepare a draft, which our team reads, edits and then sends to you. The text is stored encrypted and deleted with your account. Our AI service keeps the finished draft for up to 30 minutes, so that a repeated request does not prepare it again.

Translating messages in the chat with your agency. You and the agency's staff can each ask for a message in that chat to be translated into English, Russian or Chinese. A message is sent to OpenAI only when someone taps Translate on it, and then only its text or caption - never a photo or file, and not who wrote it or who asked. Our AI service passes the text on and keeps nothing of it once the translation is back. The translation is kept with the message, so that the next person who reads it in that language sees it without sending it again, and it is deleted together with the message.

Reading a passport or JW202. When you confirm who you are with a passport or JW202 (section 8), our AI service reads the photo again with a text-recognition model that runs on our own servers. The photo and its text are never sent to OpenAI or any other provider, and the service keeps nothing of them.

The assistant can be wrong. It is not a lawyer, doctor, immigration officer or financial adviser. Immigration rules, prices and office procedures change often and vary by city. Always confirm anything important with the official source or your university's international office.

7. Documents you upload

This is the most sensitive information in the Service, so it has its own rules.

Consent. We ask for your explicit consent before your first upload. You can withdraw it at any time by deleting the documents; withdrawal does not affect processing carried out before you withdrew.

What is stored where.

• The document file itself is stored on our object storage in encrypted form, reachable only through an authenticated request tied to your account.
• Information read from a document (such as name, document number, nationality, sex, dates) is stored on our servers so we can pre-fill forms and calculate your deadlines.
• On your phone, document identifiers are held in the operating system's secure storage (Keychain on iOS, Keystore on Android).

How a document is read. When you photograph a document, its text is first recognised on the phone itself. For a visa and the other documents, the image is not sent anywhere for recognition, and you see and can correct every field before anything is saved. A passport or a JW202 goes through the identity check in section 8: its photo is kept here and our own program reads it again on our servers, never a third party. An admission letter or a JW202 you scan in the Letter step is read on the phone too, and its photo or PDF is then kept here like your other documents; see section 9.

Screenshots. On Android we block screenshots of screens that display document identifiers.

Who can see them. Our staff do not routinely access your documents. Access happens only when you explicitly ask us to look at something in a support request, or where we are legally compelled. Every such access is logged. If you joined Qiao with an agency's code, that agency's staff can see in their partner portal and in the Qiao app the documents in your folder, their files and their expiry dates - including the photo of a passport or JW202 you used to confirm who you are (see section 19). Your helper and your parents never see your documents.

You keep your originals. Qiao is a convenience, not a system of record. It is not a substitute for carrying your passport and permits, and we are not the custodian of your official documents.

Deletion. You can delete any document at any time, including the photo of a passport or JW202 you used to confirm who you are; the name, date of birth and sex you confirmed from it stay in your profile. A deleted document is removed from our systems within 30 days and rolls out of encrypted backups within 90 days.

8. Your name, date of birth and sex from your passport or JW202

During sign-up, and later from Documents, you can confirm who you are with the photo page of your passport or with your JW202 form. You can also skip it: we then ask for your date of birth or sex only where a feature needs it - the cohort, Meet or the police registration form - and you can scan a document or type it in.

How the document is read. Your phone recognises the text on the page with Google ML Kit, on the device, and sends us that text - for a passport, also its two machine-readable lines - together with the photo or PDF. Our own program, not OpenAI or any other provider, finds in it your surname, given names, date of birth and sex and, on a passport, its number, your nationality and its expiry date. As a second opinion, our own text-recognition model, which runs on our servers, reads the photo again and keeps nothing of it. No third party reads the photo or its text, and we do not store or log the text read from the page.

The photo is kept in your Documents. The photo or PDF is always saved, encrypted, in your Documents and is handled as section 7 describes: if you joined Qiao with an agency's code, that agency can see it, like your other documents. If you use the JW202 you have just scanned in the Letter step, the app tells you first that its photo will be saved.

What is kept, and for how long. What we read stays sealed - encrypted and tied to that one scan - until you confirm or cancel it, and for an hour at most; then it is erased, and the scan keeps only technical notes without your details, such as whether the check digits matched and how clear the photo was. When you confirm, your surname, given names, date of birth and sex are saved in your profile, together with which document they came from and when you confirmed them. The passport number, nationality and expiry date are saved only if you choose to save them. If you save your nationality, we use it, like the country you chose at sign-up, to add checklist steps that depend on it, such as a document your country requires before you fly. Your name in the app becomes the name as your document prints it.

Sex. We keep your sex as male, female or not specified, as your document shows it, or as you choose it if it could not be read or you skipped the scan. We use it only to match roommates in the cohort if you look for one, to offer a Meet helper of your gender if you ask for one, and to word your arrival steps on the parent page. Other cohort members see your gender only while you are looking for a roommate.

Documents win over what is typed. A name, date of birth or sex confirmed from a document cannot be changed in the app, except for small corrections of a misread letter or digit; where your passport and your JW202 disagree, the passport wins. If something was read wrongly, scan the document again or write to us. Only our team - never your agency - can change a value that came from a document, and each such change is recorded with who made it and why.

Who sees it. Your helper sees your first name and the initial of your surname (section 11), your parents see your first name (section 12), and cohort members see your name as in your profile (section 10). If you joined Qiao with an agency's code, the agency sees your full name and your date of birth, and whether they come from a document. If a document shows that you are under 18, you are no longer shown in the cohort.

Legal basis and retention. We use these details to provide the Service (Art. 6(1)(b)). They are kept while your account exists; the photo stays in Documents until you delete it. The record of each scan, without what was read, and the record of any change our team makes are deleted with your account.

9. Admission letters, JW202 forms and chat photos

Recognition on the phone. When you scan an admission letter or a JW202 form in the Letter step - during registration or later in the app - or attach a photo in the assistant chat, the text is recognised on your phone by text-recognition models that run on the device (Google ML Kit). The image is not sent anywhere to be recognised. ML Kit may send Google technical diagnostics about the app and the device, but not your images or the recognised text. Photos the app keeps on your phone for these features are excluded from device backups.

Letters. To find your details, only the recognised text is sent to our server. Our own program - not OpenAI or any other provider - finds the university, programme, level, dates, scholarship and other study details in it and sends them back to your phone. We do not store or log the text of a letter. We never send back your name, passport number or date of birth from it. You check the details before anything is saved: what you confirm becomes part of your profile, together with the kind of document and when you scanned it. The number of a JW202 may also be kept with your documents.

The letter is kept in your Documents. Once the app recognises what you scanned as an admission letter or a JW202 form, it uploads the photo or PDF and saves it, encrypted, in your Documents, where it is handled as section 7 describes: if you joined Qiao with an agency's code, that agency can see it, like your other documents. The app may first offer a JW202 for confirming who you are (section 8): if you use it there, it is kept as section 8 describes, and otherwise it is saved as a plain document. If what you scanned is not recognised as either, the file is not uploaded and is deleted from your phone. You can delete the letter from Documents at any time (section 7); the details you confirmed from it stay in your profile.

What "scanned" means. A member who scanned a letter is marked "✓ letter" in the cohort. It means that a letter was scanned in the app; we do not check it with the university. A member whose admission was confirmed by their agency or by our team is marked "✓ agency" or "✓ Qiao" instead.

Photos in the chat. The photo itself stays on your phone. The text recognised from it is sent with your message and handled as described in section 6. We store it encrypted with the conversation for 30 days and then delete it automatically; it is also deleted when you delete your account.

10. The cohort

Your cohort is the students on Qiao going to the same university in the same intake - for example, Fudan, spring 2027.

Who is counted. If your profile has a university from our catalogue and an intake, and you are not still applying, you are counted in that cohort. We use your country, programme or level and arrival date to work out the numbers members see: how many people are going, how many are from your country, on your programme and arriving within 3 days of you, and your place in the order of joining. The numbers never include names. On our website we show numbers only, and never a number below 5. We count members on the basis of our legitimate interest in showing students who is going with them (Art. 6(1)(f)); you can object by writing to us.

Being shown is your choice. You appear in the list of people only if you agree to be shown, your date of birth - confirmed from a document or typed by you - shows that you are 18 or older, you add a Telegram or WeChat contact and your admission is confirmed - by scanning your admission letter in the app, or by your agency or our team. If your date of birth in Qiao shows that you are under 18, you cannot be shown and see only the numbers. The list is open only to members who meet the same conditions. They see your name as in your profile, your country, level and programme, departure city, arrival airport and date, whether you are looking for a roommate and, while you are, your gender (so that people of the same gender can find you), and how your admission was confirmed. Students who already study at the university and agreed to be shown may appear to newcomers as senior students, with their name, year of study and how quickly they usually reply.

Contacts only after both accept. Your Telegram or WeChat is shown to another member only when one of you sends an introduction request and the other accepts it. A person who has received your contacts may have saved them.

Hiding, blocking and reporting. You can stop being shown at any time with the switch on the cohort screen. Blocking someone hides you from each other, declines pending requests and hides the contacts you exchanged. Reports, with the reason and any note you add, go to our team. A profile reported by three different people within 30 days, or reported as belonging to someone under 18, is hidden until we review it.

Invitations. If you join through someone's invitation link, we record who invited you and let them know that someone joined through their link.

Admission lists. A partner agency, or our team, may give us a list of students admitted to a university: their email address or Telegram username, with the university and intake and, optionally, country and level. We store these addresses encrypted, together with a one-way hash used for matching, and we keep the same kind of hash of the Telegram username you give in the cohort. When a student on a list joins the cohort with the same email address or Telegram username, their admission is marked as confirmed by that agency or by our team, and their entry is removed from the list. Until then the entry stays on the list for at most 30 days after the intake starts (1 March for a spring intake, 1 September for an autumn one) or 180 days after it was uploaded, whichever comes first, and is then deleted automatically; the agency that uploaded it, or our team, can remove it earlier at any time. We do this in our legitimate interest in keeping the cohort to students who were really admitted (Art. 6(1)(f)).

How long. Your cohort record, introductions, blocks and reports are kept while your account exists, including when you change university or intake or stop qualifying for a cohort, so that blocks and reports stay in place. All of it is deleted with your account.

11. Meet: your airport helper

Meet is our airport meeting service: a student of your university meets you on arrival and helps you through your first days.

What we collect. When you book: your arrival date and flight (you can add them later), the airport, the language you want your helper to speak, whether you want a helper of your gender and your gender, how to contact you (for example WeChat, WhatsApp or Telegram), whether your helper may see your dormitory address, and who pays - you or a parent. During the service: the steps your helper marks as done and when, the photos your helper adds to those steps, the route card, any step you dispute, complaints, and your rating and comment.

What your helper sees and when.

We may record each time a helper opens your flight, contact or address. Helpers may use your details only to meet and help you.

The meeting code. Your app shows a 4-digit code. Your helper enters it when you meet, which confirms the meeting. We store the code encrypted and lock it after repeated wrong attempts.

Photos and the route card. Your helper may add a photo to a step they marked as done - for example meeting you or arriving at the dormitory - and, on the way, a route card: a short note such as the taxi's number and when you will arrive, with an optional photo. We save each photo again without its camera data, such as where it was taken, and store it encrypted. You see the photos and the route card in the app; your parents see those of the steps their page shows (section 12), but never those of a step you dispute. We delete the photos 30 days after the booking is completed, cancelled or refunded.

What you see about your helper. Their name, photo, year of study, languages, a short description, rating and number of meetings, and their WeChat from 24 hours before your arrival.

Payment. Meet is paid on our website, not through an app store. The payment page (myqiao.app/pay/…) shows the amount, what it is for - the meeting and, if you added one, a mobile data plan (section 13) - your first name, the instructions and a reference. You pay by following the instructions, and our team marks the booking as paid when the money arrives; where the page offers it, you can instead pay with Alipay, processed by Stripe, and the booking is marked paid as soon as Stripe confirms the payment. For that payment Stripe receives the amount, what it is for and an order reference (section 19). Anyone with the payment link can see that page, so share it only with the person who pays. A parent linked to you can also open it from their app (section 12). We keep the payment record - amount, currency, date, who paid (you or a parent), the payment reference and the payer details the payment method shows us - for 7 years, as accounting law requires.

Legal basis and retention. We use this data to provide the service you booked (Art. 6(1)(b)); where we keep an access record, we keep it in our legitimate interest in protecting you (Art. 6(1)(f)); payment records are a legal obligation (Art. 6(1)(c)). Booking details are kept while your account exists, except your flight, the contact you gave for the meeting and the meeting code, which we erase 30 days after the booking is completed, cancelled or refunded, together with your helper's photos. Our team receives internal alerts about bookings that need attention, for example when no helper has been found yet or a step is disputed; we delete them a year after they are resolved. When you delete your account, your contact details and the notes written about the meeting are erased, and the booking and payment records are kept, no longer linked to you, for accounting.

12. Parents: the parent link, parent accounts and payments

Your parents can follow your arrival in two ways: on a page of our website that needs no account, or in the Qiao app with a parent account linked to yours. You decide whom to give the link or the code.

The parent page. In the app you can create a link - myqiao.app/p/… - and an 8-character code that opens the same page at myqiao.app/p. There is one link per student.

What the page shows:

• your first name, city and university;
• the status of your Meet booking, if you have one - for example, waiting for payment, or that something needs our help;
• your arrival steps with times and due dates: landed, met by your helper, on the way to the dormitory, moved into the dormitory, registered with the police, bank and SIM card, applied for the residence permit. They come from your Meet booking, your checklist and the dates you entered, and are worded according to your sex where the language needs it;
• the photos your helper adds to these steps and the note of the route card, except on a step you dispute;
• your helper's name, photo, year of study, university, languages, rating and number of meetings;
• before payment, the Meet offer and a payment button; after payment, the amount and the date paid.

The page never shows your documents or document numbers, addresses, contact details or chats.

Who can open it. Anyone who has the link or the code, without signing in - so share them only with people you trust. The page is not indexed by search engines, runs no analytics and does not pass its address on to other sites. Your helper's photos on it open through signed links that work for at least an hour and then expire (a link made at 10:20 works until 12:00).

How long it works. For 180 days. You can revoke it at any time in your profile, and the link and the code stop working immediately. You can then create a new one. Revoking the link does not remove the parents who linked their accounts to yours; you remove them separately.

Parent accounts. A parent can create their own Qiao account - with an email address and a password, or with Google or Apple, and a name - and link it to yours by typing your code. You get a notification each time a parent links, and you see each linked parent's first name and their email address with most of it hidden. At most 4 parents can be linked to you. A linked parent sees in the app what the parent page shows, the photos only while they are linked to you, and, so that they do not pay for something twice, what you already have from Qiao: until when your Qiao Pass runs, whether you have the First 7 Days Pack, how many study plan reviews you have left, where your Meet stands and whether you have a mobile data plan. A parent account never sees your documents, chats, assistant conversations, addresses or contacts. Parents get notifications at the steps the page shows, and each parent can turn them off.

Removing a parent. You can remove a linked parent at any time in your profile. Their account loses access to yours at once, and your code changes, so the old code cannot link again. Removing a parent does not revoke the parent page link: if they also have the link, or opened the page with your code, revoke the link as well. A parent can also unlink themselves.

Payments between you and your parents. In the app you can ask your linked parents to pay for something, such as Qiao Pass or Meet. The ask, with the product and its price, goes to all of them; any one of them can pay or decline it, and an ask nobody answers expires after 14 days. A parent can also buy for you without being asked. A purchase a parent makes in the App Store or Google Play is the parent's purchase, made as a gift for you: we record who paid and that it is yours, and if it is refunded, we take it back from you. Meet and mobile data plans are paid through a payment link (sections 11 and 13). You see the name of the parent who paid.

Emails to parents. A parent can leave an email address on the page to receive updates. We may first send a message with a confirmation link; in that case we send updates only after the address is confirmed. Updates cover payment, the meeting, the steps and new photos from your helper, and the end of the service, at most one email every 10 minutes, and every email has an unsubscribe link. We store the address encrypted, use it only for these updates, and delete it together with the link, 30 days after the link expires or you revoke it, or with your account if that comes first; a parent can ask us to delete it sooner. The legal basis is the parent's consent (Art. 6(1)(a)).

Legal basis and retention. We provide the link, linked parent accounts and payments between you under our contract with you, and with each parent for their own account (Art. 6(1)(b)); records of who paid are an accounting obligation (Art. 6(1)(c)). The link between your account and a parent's is kept while both accounts exist, also after one of you removes it, and is deleted with either account. Your asks are kept while your account exists, and purchase records, including gifts, for 7 years.

13. Mobile data plans for China

Where available, you can order in the app a mobile data plan for China that installs on your phone as a digital SIM, without a physical card, or add one to your Meet booking. A linked parent can also order one for you. You can also buy a plan on our website without a Qiao account (see "A plan bought on our website" below).

What we collect. The plan you chose, its price and the state of the order; who pays - you or a linked parent; the payment link; the provider's reference for your plan and the last 4 digits of its SIM number; and the activation details your phone needs to install it.

The provider. We order the plan from a mobile data provider. It receives only an order reference and the plan - never your name, email address or contact details - and tells us when the plan is ready, installed or could not be made.

Payment. A data plan is paid on our website through a payment link, like Meet: the payment page (myqiao.app/pay/…) shows the amount, what it is for, your first name, the instructions and a reference. Anyone with the link can see that page, so share it only with the person who pays. A plan added to a Meet booking is a line of the same payment. You can also pay with Alipay, processed by Stripe, as for Meet (section 11).

The activation details. We keep them encrypted. The app shows them to you once, and again within 10 minutes if your phone lost them during the install. We erase them once the plan is installed, and when the order is refunded or your account is deleted.

A plan bought on our website. Where available, you can buy a plan on myqiao.app without an account. We then collect the plan, its price and the state of the order, and your email address, which we keep encrypted and use only to send you the private link to your plan and messages about this order. Stripe also receives the email address with the payment. The link shows the activation details once, and again within 10 minutes, like the app; anyone with the link can open it, so keep the email to yourself. The page it opens runs no analytics and is not indexed by search engines. We delete your email address and the link 30 days after the order ends - once the plan is installed, or the order is cancelled, refunded or the plan could not be made.

Legal basis and retention. We use this data to provide the plan you ordered (Art. 6(1)(b)) and keep the order and payment record for 7 years, as accounting law requires (Art. 6(1)(c)). When you delete your account, the order is kept for accounting, no longer linked to you. For a plan bought on our website, the order and payment record are kept the same way, and your email address is deleted 30 days after the order ends.

14. Helpers and helper applications

This section is for students of Chinese universities who apply to become Meet helpers, and for helpers.

Applications. On myqiao.app/helpers you can apply to become a helper. We collect what you enter in the form - for example your name, university, year and field of study, languages, WeChat ID or phone number, and what you tell us about yourself.

Consent. We process your application on the basis of the consent you give in the form (GDPR Art. 6(1)(a); Articles 13 and 14 of China's Personal Information Protection Law, "PIPL"). Our servers are outside mainland China, so sending the form transfers your information abroad; the form asks for your separate consent to this (PIPL Art. 39). The recipient is Duor Digital OÜ, Tartu mnt 67/1-13b, 10115 Tallinn, Estonia, support@qiaoguide.com. We use your information to consider your application, contact you and arrange an interview. You can withdraw your consent at any time by writing to support@qiaoguide.com, and we will delete your application.

Storage and retention. Applications are stored encrypted and read only by our team. If we decline your application, we delete it 30 days later; any other application that does not lead to a helper account is deleted no later than 12 months after you submitted it.

If you become a helper. At the interview we check your student card and identity document. We record when your student card was checked and when the interview took place, and we keep no copies of either document. We open a helper account for you, with which you sign in by email to our partner portal and the Qiao app (section 15). Students who view the Meet offer for your university, and their parents, see your photo and initial among its helpers. Students assigned to you see your name, photo, year of study, languages, a short description, your rating and number of meetings, and your WeChat from 24 hours before their arrival. Their parents, on the parent page or in a parent account, see your name, photo, year of study, university, languages, the mark that your student card was checked, your rating and number of meetings, and the photos and route-card notes you add to the student's steps. Your WeChat and phone number are stored encrypted. We may record each time you open a student's flight, contact or address, and we keep ratings and complaints about your meetings, as well as a record of what we owe and pay you for them - amounts, currency, dates and payment references. We keep your helper record while you are a helper, and afterwards only as long as needed for complaints, disputes and accounting.

Your rights. Under the PIPL and the GDPR you can ask to see, copy, correct or delete your information and withdraw your consent by writing to support@qiaoguide.com (see section 22).

15. Agencies, their staff and their helpers

This section is for students who joined Qiao with an agency's code, and for the people who work in Qiao for an agency or as our Meet helpers.

Partner accounts. An agency's owner, its managers and its helpers, and our Meet helpers, each have a partner account, which signs in with an email address and a password in our partner portal and in the Qiao app. Whoever creates the account - the agency's owner or our team - receives a password made by our server and shown once, and may send it to the new member by email as an invitation; it must be changed at the first sign-in. For each partner account we keep the email address, name, role and photo, the password as a hash only, when it last signed in and was last online, its sessions, the push tokens of its phones with their language and app version, and its notification settings; for a helper, also their languages, gender, cities and airports, and their phone number or WeChat, encrypted. The agency's owner sees each colleague's email address and role and whether they are online. Every change to the team and to the agency's meetings - who added or switched off whom, who assigned a helper or cancelled a meeting - is recorded with who made it and when. Switching an account off, or changing its password or email address, ends its sessions and removes its phones at once. We process this to provide our service to the agency and keep it secure, in our and the agency's legitimate interests (Art. 6(1)(f)). We keep a partner account while the agency uses Qiao, and afterwards only as long as needed for complaints, disputes and accounting.

What your agency sees. Its owner and managers see, in the partner portal and in the Qiao app, what section 19 lists - your profile, your documents and your chats with the agency - and its meetings with you. They can open your documents but cannot change or delete them. On their phones the Qiao app shows your documents and your helper's photos without saving them to the phone or its gallery, offers no download or share button, and clears its copies of chats and lists when they sign out; the partner portal on the web lets them download a document's file. On Android the app blocks screenshots and screen recording of your documents and your profile, and on iOS it hides them in the app switcher and while the screen is being recorded. Staff can also lock the app with Face ID or a fingerprint.

Your agency's airport meeting. Where your agency offers it, you can book in the app a free airport meeting with one of its helpers. We collect the same details as for Meet (section 11), but no payment, and keep and erase them the same way. Your agency's owner and managers always see their meetings with you in full: your arrival date and time, flight and airport, the language you asked for and whether you want a helper of your gender, the contact you gave for the meeting, your dormitory address if you let your helper see it, the steps with the helper's photos and notes, the meeting's history, and your rating and any complaint. They can also book a meeting for you, change it, assign or replace your helper and confirm that you met. A serious complaint also reaches our team.

What your agency's helper sees. Your agency's helper - in the app, its representative - is someone your agency chose and checked, not one of our Meet helpers. They see only the meetings assigned to them - never your documents, your chats or the agency's students. Once assigned, they see your first name and the initial of your surname, your country, arrival date and airport, and the language you asked for. Only from 48 hours before your arrival until 72 hours after the meeting is completed do they also see your flight, your contact and, only if you allowed it, your dormitory address in Chinese. As with Meet, we may record each time a helper opens your flight, contact or address. When your agency replaces your helper or the meeting is cancelled, the helper loses this access at once. You see your helper's name, photo and languages.

Your agreement. The meeting form tells you that your flight and contact go to your agency's helper, and by booking you agree to pass them on. If your agency booked the meeting for you, it entered these details itself: the app then asks you to check them, shows you the same line, and lets you correct them or cancel the meeting.

Legal basis. We provide your agency's meeting under our contract with you (Art. 6(1)(b)), and keep an access record, where we keep one, in our legitimate interest in protecting you (Art. 6(1)(f)). Your agency is an independent controller for what its staff and helpers do with what they see (section 19).

16. Notifications and push

If you turn notifications on, we register your device to receive them.

• On iOS we use Apple Push Notification service (APNs).
• On Android we use JPush (Aurora Mobile / 深圳市和讯华谷信息技术有限公司), a Chinese push provider. We use it because Google's Firebase Cloud Messaging does not work in mainland China. JPush is located in China and receives your push token, basic device and network information, and the text of each push it delivers to your phone. If you prefer not to use it, you can decline notification permission - the app continues to work and shows your deadlines in the app and on the widget instead.
• Some reminders are scheduled locally on your device and are not sent through any server at all.
• Besides deadline reminders, we notify you about cohort introductions, your Meet booking or your agency's meeting, your study plan review, announcements from your agency, parents who link to you and what they pay for you or decline, and, around your arrival, at most one suggested next step a day.
• In a parent account, we notify you about the steps of your child's arrival that the parent page shows, what your child asks you to pay for, and your payments.
• In a partner account, we notify you about students' messages and the agency's meetings, or, as a helper, about your meetings. By default the lock screen shows only the student's name, not the message; you can change this, and turn either kind off, in your profile.

What a push carries. The text of every push - for example the sender's name and the text of a chat message - passes through APNs or JPush, depending on the phone it goes to. Pushes about you can also go to other people's phones: your parents', and, if you joined Qiao with an agency's code, its staff's. On the Android phones of your agency's owner, managers and helpers, JPush therefore receives what their pushes show of you: your name, with the text of your new message if the staff member turns message text on, and your meeting's date and airport. Declining notifications on your own phone does not stop pushes about you to other people's phones.

You can turn notifications off at any time in the app or in your device settings.

17. Location

Location permission is optional. If you grant it, your position is used to centre the map and to sort nearby places. Coordinates are used on your device; we do not store a history of where you have been. Refusing permission only means the map opens on your city instead of on you.

18. Website, cookies and analytics

Cookies the site needs. On myqiao.app we keep these cookies in your browser. They make the site work and remember what you chose, are never used for analytics or advertising, and so do not need your consent:

Analytics, only if you accept them. When you first open the site, a banner asks whether we may use analytics, with two equal buttons: Accept analytics and Reject. Until you accept, no analytics script is loaded and your browser sends nothing to Google; rejecting, or not answering, changes nothing else on the site. If you accept, we load Google Analytics 4, provided by Google Ireland Limited, with Google LLC in the United States. It counts visits and the pages and events you see, with your browser and device details and the page you came from; it uses your IP address to estimate your country and city and does not store it. Its cookies: _ga and _ga_1QHPFR0VFF (2 years).

The legal basis is your consent (GDPR Art. 6(1)(a), and Art. 5(3) of the ePrivacy Directive as applied in Estonia); the transfer to Google LLC in the United States relies on the EU-US Data Privacy Framework (section 20). The services that receive data from the site are listed in section 19.

Changing your mind. You can change or withdraw your choice at any time with Cookie settings in the site footer, as easily as you gave it. If you withdraw it, the page reloads so the script stops, and we delete its cookies on myqiao.app; this does not affect what it processed before. We ask again after 6 months, or sooner if this section changes.

Pages without analytics. The parent pages (myqiao.app/p, where a parent types the code, and myqiao.app/p/…), the payment page (myqiao.app/pay/…), the request tracker (myqiao.app/…/request), the page of a mobile data plan bought on our website, the admin area and the partner portal run no analytics, whatever you chose, and the private ones among them are not indexed by search engines. The scholarship-chances test on the website works without an account: your answers are used to calculate the result and are not stored unless you tap “Continue in the app”. Then the answers and the result are kept for 30 days under a random code and deleted when the code expires.

The app. The mobile app does not use cookies or a third-party analytics service: the usage described in section 3.2 is recorded on our own server.

19. Who we share data with

We share personal data only with the processors below, each under a written data-processing agreement, and only to the extent needed.

Other users and people you choose. Members of your cohort see what section 10 describes, your helper sees what section 11 describes (for your agency's meeting, section 15), and your parents - through the parent link or a linked parent account - see what section 12 describes.

Helpers. Our Meet helpers are students of Chinese universities whom we have checked; your agency's helpers are people your agency chose and checked. They see your details only for your booking, only within the times set out in sections 11 and 15, and may use them only to meet and help you.

Partner agencies. If you enter an agency code, that agency becomes an independent controller for the data you share with it through the agency chat, for your application, for its airport meetings with you and for what it does with what it sees about you in its partner portal and in the Qiao app. Its own privacy policy applies to what it does with that data. In its partner portal and in the Qiao app the agency sees your name and email address, your profile photo, your country, city and university, your arrival status and date and your other questionnaire answers, your date of birth and whether it comes from a document, the expiry dates of your documents, the documents in your folder and their files - including the photo of a passport or JW202 you used to confirm who you are - when you joined and were last active, your chats with it and its meetings with you (section 15). To let it confirm your admission for the cohort, it also sees your intake, whether you are counted and shown in the cohort, whether you scanned your admission letter, whether your admission is confirmed and whether you are 18 or older. An agency cannot change a name, date of birth or sex taken from your documents. If you send a request for admission help, we pass it to the partner agency we choose for it; the agency sees the request in its partner portal, contacts you, and is an independent controller for what it does next.

Partner service providers. If you buy a service that a partner provides, we pass to that provider only what it needs to serve you. Each provider is an independent controller for what it then does. We tell you who the provider is before you buy.

Other disclosures. We may disclose data where required by law, to enforce our Terms, to protect the rights and safety of users or the public, or as part of a merger or acquisition - in which case we will tell you before your data becomes subject to a different policy.

20. International transfers

Some of our processors are outside the European Economic Area. Where we transfer personal data outside the EEA we rely on:

• an adequacy decision of the European Commission, where one covers the country; or
• the European Commission's Standard Contractual Clauses, combined with a transfer impact assessment and, where needed, additional technical measures such as encryption and minimisation.

Transfers to China (push delivery via JPush) deserve particular attention: China is not covered by an adequacy decision. JPush receives a push token, basic device information and the text of each push it delivers - never your documents, but the sender's name and text of a chat message, and on the Android phones of your agency's staff and helpers your name, the text of your message if they turn message text on, and your meeting's date and airport (section 16). Declining notification permission stops this transfer for pushes to your own phone, not for pushes about you to other people's phones.

Transfers to the United States to Google LLC and Stripe, Inc. rely on the EU-US Data Privacy Framework, under which both are certified, and otherwise on the Standard Contractual Clauses.

Helpers in China. When you book Meet or your agency's meeting, the details your helper needs are shown to a helper in China, within the limits set out in sections 11 and 15. This transfer is necessary to provide the service you booked (GDPR Art. 49(1)(b)).

Helper applications are sent from China to our servers outside China with the applicant's separate consent (section 14).

You can ask us for a copy of the safeguards in place by writing to support@qiaoguide.com.

21. How long we keep data

After you delete your account, we remove your personal data from our live systems within 30 days, and it disappears from backups within 90 days. We keep only what the law requires us to keep - principally accounting records of purchases, including gifts, Meet bookings, mobile data plan orders and payments, no longer linked to you - requests for admission help that a partner agency may still be handling, and a minimal record that an account with that email was deleted, so that we do not recreate it by mistake.

22. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• rectify data that is inaccurate or incomplete - most of it you can edit yourself in the app; a name, date of birth or sex taken from a document you correct by scanning the document again or by writing to us (section 8);
• erase your data ("right to be forgotten");
• restrict processing in certain circumstances;
• portability - receive the data you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller where technically feasible;
• object to processing based on our legitimate interests, on grounds relating to your particular situation;
• withdraw consent at any time, where processing is based on consent - for example for documents, notifications, location, being shown in the cohort, email updates to parents or a helper application. Withdrawal does not affect the lawfulness of processing before withdrawal;
• not be subject to a decision based solely on automated processing that produces legal effects concerning you. We do not make such decisions.

How to exercise them.

• Delete your account: Profile → Delete account in the app.
• Stop being shown in the cohort: the switch on the cohort screen.
• Revoke the parent link or remove a linked parent: in your profile in the app.
• Delete a document, including the photo of your passport or JW202: in Documents in the app.
• Everything else: write to support@qiaoguide.com.

We answer within one month. If a request is complex we may extend by two further months and will tell you why. We may ask you to confirm your identity before acting on a request. Exercising your rights is free; we may charge a reasonable fee or refuse only where a request is manifestly unfounded or excessive.

Complaints. If you think we have handled your data wrongly, please tell us first - we would rather fix it. You also have the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, info@aki.ee, www.aki.ee) or to the supervisory authority of the EU country where you live or work.

23. Security

We take the following measures, among others:

• all traffic protected with TLS;
• passwords stored only as salted cryptographic hashes, never in readable form;
• short-lived access tokens with rotating refresh tokens and server-side revocation;
• document identifiers held in the device's secure enclave (Keychain / Keystore);
• uploaded files stored encrypted and served only through authenticated, expiring links;
• screenshot blocking on Android for screens showing document identifiers;
• contact details in the cohort and in Meet bookings, parents' email addresses, helpers' contact details, study plan texts, text recognised from chat photos and helper applications additionally encrypted in our database;
• what a passport or JW202 scan reads sealed for at most an hour, and the text read from a document never stored or written to our logs;
• the text of admission letters not stored, and recognised text never written to our logs;
• photos from helpers stored encrypted and opened only through signed or signed-in links;
• activation details of mobile data plans stored encrypted, shown once and erased once the plan is installed;
• parent and payment links built on long random tokens, with rate-limited access; a revoked link stops working at once;
• limited attempts to link a parent account with a code, and a new code once you remove a parent;
• meeting codes stored encrypted and locked after repeated wrong attempts; helpers' access to students' details limited in time and logged;
• on the phones of agency staff and helpers, students' documents and step photos never saved to the phone, screenshots and screen recording of documents and students' profiles blocked on Android, and an optional Face ID or fingerprint lock;
• a partner account's sessions ended and its phones removed at once when it is switched off or its password or email address changes;
• rate limiting and lockouts on authentication;
• least-privilege internal access, with document access logged;
• encrypted, off-site backups;
• error monitoring and alerting.

No system is perfectly secure. If a breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, and the supervisory authority within 72 hours as the GDPR requires.

24. Users in mainland China

The Service is used mainly by people located in mainland China. Please be aware that:

• our servers are outside China, so using the Service involves transferring your data across borders;
• we ask for your separate consent to this when you create an account;
• network conditions in China may delay or prevent notifications and connections. We use local delivery methods where we can, but we cannot guarantee delivery;
• we do not operate the Service under a Chinese ICP licence and do not target Chinese nationals as a domestic service. The one part addressed to Chinese students is the application to become a helper (section 14).

If China's Personal Information Protection Law applies to our processing of your data, we will honour the rights it gives you to the same standard as the GDPR rights above.

25. Children

The Service is for people aged 16 and over. We do not knowingly collect personal data from anyone under 16. If you believe a child under 16 has given us personal data, write to support@qiaoguide.com and we will delete it.

The cohort is for people aged 18 and over. If your date of birth in Qiao shows that you are under 18, you cannot be shown in a cohort, see its list of people or exchange contacts there - you see only its numbers.

26. Changes to this policy

We may update this policy. When we do, we change the version and date at the top and publish the new text at myqiao.app/privacy. If a change materially affects your rights, we will tell you in the app or by email at least 14 days before it takes effect, so you can object or delete your account. Continuing to use the Service after that date means the new policy applies to you.

Previous versions are available on request.

27. How to contact us

Duor Digital OÜ Tartu mnt 67/1-13b, 10115 Tallinn, Estonia Registry code 17631584

• Privacy: support@qiaoguide.com
• Support: support@qiaoguide.com

We have not appointed a Data Protection Officer, as we are not required to. Privacy enquiries go to the address above and are handled by our management.