We will appoint an EU and a UK representative under GDPR Art. 27 / UK GDPR Art. 27 before serving EU / UK users on a paying basis and will publish the contact details on this page.
§1 What this document covers
This Privacy Policy applies to (a) the marketing website lechuangtech.com operated by Lecron AI Co., Limited ("Lecron AI", "we", "us"), (b) the mobile management apps published by Lecron AI on Google Play and Apple App Store, and (c) any enterprise service interaction initiated via the contact page or via direct email. The mobile apps are the consumer-facing arm of our cloud, hardware, software, and consulting business lines; they are integrated into our Services rather than treated as separate products.
This Privacy Policy does not cover third-party sites or apps we link to — for example recruitment platforms, news outlets, app stores, or vendor marketplaces. When you click an outbound link, the destination operator's privacy policy applies; we encourage you to read it.
§2 Categories of personal data we collect
We collect six categories of personal data. Examples in each category illustrate what you might provide or what we might observe; we do not necessarily collect every example listed, and we collect only what we need.
Account & contact data. Name, business email, company, role, country, language preference.
App telemetry & device data. IP address (often truncated), device model, OS version, app version, language, locale, time-zone, mobile ad ID (Google Advertising ID on Android / Apple's IDFA on iOS), in-app event tags, crash logs and stack traces.
Advertising data. Ad impressions served, ad clicks, rewarded-video completions, conversion events (anonymised where possible), frequency-capping tokens, latency to render.
Cookies & SDK storage.httpOnly session tokens, IAB _dcf consent cookies (iframes), ad-network pseudonymous IDs.
§3 How we collect personal data
You give it to us. Via forms on this site (e.g. the contact form), via email, via App Store reviews, and via support tickets.
We collect it automatically. Via first-party SDKs (analytics, A/B test frameworks, error tracking) and via third-party SDKs (the ad platforms enumerated in §8) and via standard server logs (HTTP access logs, application logs).
We receive it from app stores. Public developer-console events like install counts, ratings, and reviews. On Google Play we receive install referrers; on iOS we receive SKAdNetwork postbacks. These are not used for advertising on lechuangtech.com.
§4 Why we use it (purposes) + lawful bases under GDPR
We process personal data only for purposes that fit one of the GDPR Article 6 bases (or its regional equivalent). The table below maps each purpose to the basis we rely on in the EU and UK, plus a note on the other regional regimes.
Purpose
Personal data
GDPR Art. 6 basis
Other regional basis
Provide and improve our cloud / data / hardware services
Account + usage
(b) performance of contract, (f) legitimate interests
—
Operate and secure our website and apps
Telemetry, usage, device
(f) legitimate interests
—
Display advertising in our apps
Advertising data, IDFA / GAID
(a) consent (EU / UK), (f) elsewhere where permitted
CCPA / CPRA: opt-out basis
Match users to ad campaigns, frequency-cap, fraud prevention
Pseudonymous ad IDs
(a) consent (EU / UK), (f) elsewhere where permitted
LGPD Art. 7 (legitimate interest only with safeguards); PIPL Art. 13(2) where consent is the safe default
Respond to support requests
Email content, attached files
(b) or (a)
—
Comply with legal obligations
Any
(c) legal obligation
All regions
Marketing emails to B2B contacts
Email, role, company
(f) legitimate interests + opt-out
CAN-SPAM (US), PECR (UK), CASL (CA) — opt-out only
§5 Cookies & local storage on the website
We use three classes of cookies on lechuangtech.com:
Strictly necessary — a first-party session cookie that prevents cross-site request forgery and remembers your cookie-banner choice. No consent is required for this class under EU / UK law.
Analytics — pseudonymous, first-party analytics cookies (page views, scroll depth). Loaded only after explicit consent in EU and UK; loaded on an opt-out basis elsewhere.
Advertising — not used on lechuangtech.com. All advertising happens in our mobile apps, not on the website. The site has no ad-network iframes, no third-party trackers, no pixels that share data with ad networks.
Our cookie banner logic is opt-in by default for non-strictly-necessary categories in the EU and the UK, and opt-out elsewhere. The Global Privacy Control (GPC) signal is honoured as an opt-out everywhere we deploy cookies.
§6 Sharing personal data
We share personal data in three categories of contexts:
Service providers under written agreement. Hosting, email, error tracking, CI/CD — each bound by a data processing agreement consistent with GDPR Art. 28 (or equivalent).
Ad-SDK vendors. The vendors itemised in §8 receive ad-relevant data directly from the app at runtime, per the developer's configuration.
Legal / regulatory disclosures. When compelled by valid legal process, or to defend lawful claims, or to protect the safety of users and the public.
We do not sell personal data. We do not share personal information for "cross-context behavioural advertising" as defined in CPRA §1798.140. The "Do Not Sell or Share My Personal Information" link is therefore not currently required, but if your region requires it in the future we will publish it from the footer of every page.
§7 International data transfers
Lecron AI Co., Limited is a Hong Kong entity and is the exporter of personal data for most users. The transfer mechanisms we rely on:
EU / UK → Hong Kong. Standard Contractual Clauses (EU 2021/914) plus the UK International Data Transfer Addendum, with a Transfer Impact Assessment (TIA) on file. The TIA considers Hong Kong's data-protection law (PDPO Cap. 486) and Section 8 of the Safeguarding National Security Ordinance.
CN / PIPL → Hong Kong. PIPL Art. 38 requires one of three mechanisms — a security assessment by the Cyberspace Administration of China, a standard contract, or a personal-information protection certification. We rely on the standard contract for B2B contacts and on the certification track for any cross-border B2C flow inside our apps.
Cross-border ad-SDK flows. For example, Pangle routes mainland-China traffic through Beijing; Google routes outside mainland traffic to the United States; AppLovin MAX uses regional mediation servers. Each vendor's flow is itemised in §8 and Appendix A.
§8 Third-party ad SDKs used in our mobile apps
Each sub-section below follows the same five-point structure: (a) what it does · (b) data it receives · (c) lawful basis · (d) opt-out · (e) privacy policy link. Our full vendor table is reproduced in Appendix A for quick reference.
8.1 Google AdMob
(a) What it does
AdMob fills ad requests across our apps via waterfall and in-app bidding. It selects ads from Google's ad inventory and from mediated third-party networks when bid responses are eligible. It also enforces frequency caps and renders rewarded-video, interstitial, banner and open-screen (splash) ad formats.
(b) Data it receives
Advertising ID (Google Advertising ID on Android / Apple's IDFA on iOS), IP address (truncated), coarse location (country/IP-derived), app ID, device make/model, OS version, ad impression and click events, frequency-capping cookies, SDK version, in-app session identifier.
(c) Lawful basis
EU / UK: GDPR Art. 6(1)(a) consent, managed via our in-app CMP (consent management platform) for ad selection and measurement. Elsewhere: legitimate interest subject to applicable local rules (e.g., CAN-SPAM, LGPD Art. 7).
(d) Opt-out
Android: Settings → Google → Ads → Opt out of personalisation. iOS: Settings → Privacy → Tracking → toggle off "Allow Apps to Request to Track". Web: users of lechuangtech.com may submit a Global Privacy Control (GPC) signal; the site honours GPC as opt-out.
GAM is Google’s programmatic direct / ad-server stack. It provides reserved inventory, private auctions, and Open Auction in our apps. GAM lines up campaigns, runs real-time bidding, and serves creatives.
(b) Data it receives
Same as AdMob, with the addition of line-item targeting keys, position-in-app, viewability events (per Open Measurement), and the GAM session identifier (rdid / adid).
(c) Lawful basis
EU / UK: consent (Art. 6(1)(a)). Elsewhere: legitimate interest per local law, with the CAN-SPAM, LGPD Art. 7, and PIPL Art. 13(2) touch points called out in §4.
(d) Opt-out
Same as AdMob: Google Ad Settings / iOS Tracking toggle. Publishers may also use GAM's policy tools to block specific advertisers.
Meta’s mediation network. Fills Facebook / Instagram ads in our apps via waterfall + bidding, and supports native, interstitial, banner and rewarded-video formats.
(b) Data it receives
Advertising ID, IP address, device make/model, OS version, app ID, event tags (impression, click, completion), Facebook user identifier if logged in, Meta Pixel attribution events (server-to-server).
(c) Lawful basis
EU / UK: consent per Art. 6(1)(a). Elsewhere: legitimate interest subject to local rules including CAN-SPAM, LGPD Art. 7, PIPL Art. 13(2).
(d) Opt-out
Facebook Settings → Ad Preferences → "Data about your activity from partners" → toggle off. iOS Tracking toggle also applies.
Game-style monetisation — Unity Ads mediates across rewarded video, interstitial, banner and AR ad formats, with a Unity-Operate dashboard for publishers.
(b) Data it receives
Advertising ID, IP address, device make/model, OS version, app ID, in-app session identifier, IAB consent string when passed in.
(c) Lawful basis
EU / UK: consent. Elsewhere: legitimate interest per local rule, including CAN-SPAM, LGPD Art. 7.
Header-bidding mediation wrapper. AppLovin MAX bids every impression across the networks we have configured, and runs the winner. It also provides a unified analytics dashboard.
(b) Data it receives
Advertising ID, IP address, device make/model, OS version, app ID, ad impression and click events, MAX SDK identifier.
(c) Lawful basis
EU / UK: consent (Art. 6(1)(a)). Elsewhere: legitimate interest per local rule (CAN-SPAM, LGPD Art. 7, PIPL Art. 13(2)).
(d) Opt-out
"Opt out of personalisation" SDK flag in our app configuration; iOS Tracking toggle.
Mediation platform plus user-acquisition tools. Routes ad calls across configured networks, and supports rewarded video, interstitial, banner and offerwall formats.
(b) Data it receives
Advertising ID, IP address, device make/model, OS version, app ID, SDK version, ad impression and click events, session identifier.
(c) Lawful basis
EU / UK: consent (Art. 6(1)(a)). Elsewhere: legitimate interest per local rule.
(d) Opt-out
SDK do-not-sell flag in our app configuration; iOS Tracking toggle.
TikTok-family mediation platform. Fills ads from Pangle's Chinese-inventory network (Beijing data centres) and from international demand sources, in the formats listed in §9.
(b) Data it receives
Advertising ID (where available), IP address, device make/model, OS version, app ID, ad impression and click events, location (with consent), Pangle session identifier.
(c) Lawful basis
EU / UK: consent (Art. 6(1)(a)). Mainland China: PIPL Art. 13(1)–(2) consent. Elsewhere: legitimate interest per local rule.
Each paragraph below describes one format. We list (1) what the format is, (2) when the user encounters it, (3) what data is collected for it, and (4) how the user can control it.
9.1 Open-screen (splash) ads
The very first ad shown on app launch — typically a static or short-video full-screen creative that runs while the app loads its content. The mediation layer renders it. We log impression and click events; on iOS the impression is paired with an SKAdNetwork postback for attribution; on Android the impression is paired with a Google install-referrer event. The user controls open-screen ads via the platform opt-outs in §8 (Google Ad Settings on Android, iOS Tracking toggle on iOS, GPC on the web).
9.2 Rewarded video ads
User-initiated. The user explicitly opts in to watch a full video in exchange for an in-app reward (currency, hint, feature, etc.). The SDK verifies completion server-side before releasing the reward token; the token is logged. The user can decline to enter the offerwall, or simply close the offerwall without watching. Frequency capping and reward budgets are configured per game.
9.3 Interstitial ads
A full-screen ad at a natural transition — between pages, on completion of a flow, or on exit. Impression and close events are logged. Frequency capping is enforced by each mediated network to avoid back-to-back intrusions. The user can exit the interstitial at any time via the standard Close button.
9.4 Banner ads
A persistent inline rectangle that stays on screen while the user works. Viewability is measured via the OM SDK (IAB Open Measurement). An impression is counted when at least 50% of pixels are viewable for at least 1 second, and a "viewable impression" is logged. Refresh intervals and ad sizes are configured per placement.
§10 Age restrictions + children protections
This block describes how we treat users who are children in each regime we operate in. The block is always on; opt-ins are per region.
COPPA (United States, < 13)
Lecron AI does not knowingly collect personal data from US children under 13. We do not run interest-based advertising to that audience. Parents and legal guardians may request deletion of any inadvertently collected data via dpo@lechuangtech.com. The Google Play "Families Policy" and Apple "Kids Category" rules constrain our apps: when an app is rated under Families, we disable every interest-based ad SDK and every behavioural-targeting profile.
GDPR-K (European Union + United Kingdom, < 16 by default with member-state derogations)
Under EU GDPR Recital 38 + Art. 8, the default age of consent is 16 unless lowered by a member state. Portugal lowered to 13; France operates with 15 since the 2023 digital-majority reform; Italy operates with 14 under §2 of the Codice della Privacy; Spain operates with 14 under LOPDGDD Art. 11. The Netherlands and the Republic of Ireland operate with 16. For member states where the local provision is ambiguous we default to 16 and treat users below that age as children. We do not run interest-based advertising to anyone we identify as a child; we do not require accounts from children for any non-essential reason; we honour parental deletion requests within 30 days under §10.4 below.
UK Age-Appropriate Design Code (AADC — Information Commissioner's Office)
The UK AADC applies to all children under 18 in the UK. We honour its 15 standards: high-privacy settings by default, no behavioural advertising to children, a Data Protection Impact Assessment (DPIA) before launch, no dark patterns, transparent terms, no unnecessary data collection, no data-sharing beyond what is "reasonably necessary", and so on. Our DPIA is on file and may be requested under NDA.
Take-down
If we discover that personal data was collected from a child without verifiable parental consent, we delete it within 30 days and report the incident to the relevant supervisory authority where applicable.
§11 Your rights per region
11.1 EU + UK — GDPR / UK GDPR
You have the rights of access, rectification, erasure (the "right to be forgotten"), restriction of processing, data portability, objection (including to direct marketing and to profiling), and the right not to be subject to a solely automated decision with legal or similarly significant effect. You also have the right to lodge a complaint with your local supervisory authority. To exercise a right, email dpo@lechuangtech.com; we respond within 30 days (extendable to 90 days for complex requests, with notice). The supervisory authority for our registered office (Hong Kong) is the Office of the Privacy Commissioner for Personal Data (PCPD); for users in the EU / EEA the lead supervisory authority will be appointed once our EU representative is published per §A.0.
11.2 California (US) — CCPA / CPRA
You have the rights to know, delete, correct, opt out of sale / sharing (which we have not engaged in — see §16), and limit the use of sensitive personal information. We do not discriminate against you for exercising any right. The "Do Not Sell or Share My Personal Information" link is published from the site footer; though we do not currently sell or share, the link is provided in case the policy changes. Response time: verifiable consumer requests are answered within 45 days.
11.3 Mainland China / Hong Kong — PIPL + PDPO
You have the rights to know, access, correct, delete, port your data, withdraw consent, and lodge a complaint with the Cyberspace Administration of China (CAC) for mainland residents, or with the Privacy Commissioner for Personal Data (PCPD) for Hong Kong residents. Cross-border transfer objections are handled per §7. Response time: within 30 days for verifiable requests.
11.4 Brazil — LGPD
You have the rights of confirmation of existence, access, correction, anonymisation, portability, deletion, information about sharing, consent withdrawal, and the right to lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD). Response time: within 15 days.
You have the rights of access and challenge to accuracy under PIPEDA. Provincial statutes (e.g., Quebec Law 25, Alberta PIPA, BC PIPA) are honoured where they apply — for example the right to be forgotten and the right to data portability under Quebec Law 25. Response time: within 30 days.
11.6 Australia — Privacy Act 1988 (Cth) + APPs
You have the rights of access, correction, and complaint to the Office of the Australian Information Commissioner (OAIC). Response time: within 30 days.
11.7 Singapore — PDPA 2012 + 2020 amendments
You have the rights of access, correction, consent withdrawal, opt-out of telemarketing, and complaint to the Personal Data Protection Commission (PDPC). Response time: within 30 days.
§12 Security measures
We apply four categories of control. None of these are guarantees — security is a continuous practice, not a one-off exercise.
Organisational
Role-based access controls, audit logs on every production system, background checks on hires with access to customer data, mandatory security training, secure-development lifecycle (SDLC), and a written incident-response plan reviewed quarterly.
Technical
TLS 1.2+ in transit on every customer-facing endpoint; AES-256 encryption at rest; key management via a cloud KMS with rotation; penetration tests by an independent firm annually; continuous vulnerability scanning; web application firewall in front of lechuangtech.com.
Physical
Our data centres are operated by Tier-A cloud providers with their own SOC 2 Type II, ISO 27001, and PCI DSS certifications. Physical access is controlled by the operator; we inherit their controls.
Incident response
On confirmation of a notifiable personal-data breach, we notify the relevant supervisory authority within their statutory window: 72 hours under GDPR Art. 33; within a reasonable time under PIPL Art. 57(1); within the period required under the California Attorney General's breach notification guidelines; within two business days of all relevant facts under LGPD Art. 48.
§13 Data retention
We retain personal data only for as long as we have a purpose under §4. The following table summarises our typical retention periods, ending in either deletion or irreversible anonymisation.
Category
Retention
Account & contact data
Duration of contract + 7 years (tax / legal record)
App telemetry
24 months in identifiable form; thereafter aggregated
Advertising data
13 months (IAB standard), unless you request earlier deletion
Support emails
3 years from last contact
Crash logs
18 months
Server logs
90 days
§14 Your rights regarding direct marketing
B2B marketing emails carry a one-click unsubscribe header (List-Unsubscribe-Post) per RFC 8058, plus a plain-English unsubscribe link. PECR + UK GDPR: we run an ICO-regarded "soft-opt-in" flow for B2B only — that is, we email existing customers about similar products. US CAN-SPAM: a physical postal address is published in the footer of every marketing email (Room 6, 29/F, 32 Hung To Road, Kwun Tong, Hong Kong). You may also opt out by replying "unsubscribe" or by emailing dpo@lechuangtech.com.
§15 Children's mobile apps
If any of our apps is rated ESRB E, IARC 7+, or under one of the Google Play "Families" tiers (Teacher-approved, Ages 5 & under, Ages 6–8, Ages 9–12) or the Apple "Kids Category" (Apple App Store Review Guidelines §1.4.3), we disable interest-based advertising and every advertising SDK enumerated in §8 — per Apple's §1.4.3 and Google's "Families Policy". Data collection is restricted to what is "reasonably necessary" for the app to function; behavioural targeting is off; persistent identifiers are not shared with third parties for advertising.
§16 Do Not Sell / Share / Targeted Advertising
We do not sell personal information as defined by CCPA §1798.140. We do not share personal information for "cross-context behavioural advertising" as defined in CPRA. We honour Global Privacy Control (GPC) as a valid opt-out signal wherever we set cookies or trigger ad-SDK configurations. Should our business model change such that a sale or share occurs, we will: (1) update this section with 30 days' notice, (2) provide a "Do Not Sell or Share My Personal Information" link from the footer of every page, and (3) honour prior opt-outs.
§17 Changes to this policy
Material changes — defined as changes that broaden our data-collection or weaken our commitments to you — will be announced with 30 days' notice on the homepage and via an in-app banner. Non-material changes — defined as copy edits, clarifications, or the addition of new vendors from §8 — will be reflected in the "Last updated" date at the top of this page. The previous version of this policy is available on request for 24 months after a change.
§18 How to contact us & lodge a complaint
For any question, request, or complaint, contact us via the channel that fits:
EU / UK representative — see §A.0 note; will be published before serving EU / UK users on a paying basis
Postal — Room 6, 29/F, 32 Hung To Road, Kwun Tong, Hong Kong
You may always escalate to your local supervisory authority (see §11). For Hong Kong: PCPD (pcpd.org.hk). For EU / UK: your lead supervisory authority (a list is published by the EDPB).
Appendix A Vendor table (consolidated)
The 20 vendors itemised in §8 — reproduced here as a quick-reference table. The five-point blocks in §8 are the operative disclosures; this table is a summary.