Privacy Policy

ImportMate – Taobao & 1688 Image Downloader + AI Sourcing Advisor (Chrome extension)

Provided by: EasyFlow Studio ("we", "us")

Last updated: October 24, 2026

This policy explains what data the extension collects, where it is stored, who receives it, how long it is kept, and how you can view and delete it.

Summary

• You can use it without signing in: scanning product pages, previewing, selecting media and downloading with a license key all happen in your browser and do not go through our server.
• Data is stored on our server only after you sign in with Google: your account, download license, free-trial record, AI quota, synced product notes and AI memory. The server runs on Google Cloud.
• AI advisor: your question and any product images you choose to attach are sent to Anthropic's Claude or Google's Gemini to generate an answer. Our server does not store the content of questions, answers or images; it keeps only usage numbers, deleted automatically after 180 days.
• Ask AI to sort them: on a site without a fast lane (or when the fast lane can't read a page), pressing this button sends that page's picture list (sizes, file names, alt text and similar, not the pictures themselves and not their full addresses) to Google Gemini to be sorted. Our server does not store the content of the list (see 6-8).
• AI photo touch-up: when you press "Touch up", the one product photo you chose is sent to Google Gemini to change the background, fix the lighting and crop it to a ratio. Our server stores neither the original nor the touched-up photo (see 6-9).
• We do not sell your data or use it for advertising.
• After signing in, you can use "Download my data" or "Delete account data" on the account page at any time.

1. Features that do not require sign-in (processed in your browser)

1-1 Product pages and media

When you request a scan, capture more media or use the batch queue, the extension reads the product page you selected: its URL, title, product ID, image and video sources, variant information and other information needed to complete the download. Adding the product tabs of the current window identifies supported product tabs in that window. Tmall Global (tmall.hk), 1688 (1688.com), AliExpress (aliexpress.com, aliexpress.us; images and videos on aliexpress-media.com) and Alibaba.com (alibaba.com) pages are read only after you press "Allow" in Chrome.

Other websites (sites without a fast lane yet): when you press "Grab everything" on a page, Chrome first asks whether to allow the extension to read that one website, and it is read only after you press "Allow". The extension reads the image and video sources on that page, their sizes, alt text, which part of the page each picture is in and the short text next to it, the page title and the text on option buttons, so it can list the pictures for you to tick. When you download, if the pictures are stored on other websites, Chrome asks once more whether to allow reading those websites. All of this happens in your browser and is not sent to our server; we do not read or keep the whole web page. You can remove any website you allowed at any time in Chrome's extension settings.

Media is retrieved from the source websites (Taobao, Tmall, Tmall Global, 1688, AliExpress, Alibaba.com, alicdn.com, aliexpress-media.com, and any website where you press "Grab everything" together with the websites that store its pictures). Previewing, organizing, converting images and ZIP packaging take place in your browser. Source websites receive the network requests needed to provide their content and handle them under their own policies. We do not track your complete browsing history.

1-2 Data stored on this computer

The extension stores the following in Chrome's extension storage on this computer only:

• Product notes: source URL, product title, your own product name, supplier name and link, purchasing status, notes, variant mappings (including your own SKU codes) and the media list.
• The batch queue, processing status, download preferences, language, display and onboarding preferences.
• License key and activation records, trial dates (a backup of the license key is also kept in Chrome sync storage, see 1-4).
• New in 4.0 (only after sign-in): your sign-in state (kept by the Firebase sign-in component, including your account ID, email, name, profile photo URL and sign-in tokens), an account summary (account ID, email, name), cached download-license and trial end dates, your account's backup license key (see section 3), and a random ID for this computer (a random string generated by the extension, not hardware information).
• AI conversation history (see section 6).

Notes contain what you choose to enter; please do not include unnecessary sensitive information or other people's personal data. When you sign out, the account summary, license cache, trial cache and backup license key are removed from this computer; the local license key and any 3.8.x trial record are left unchanged.

1-3 License verification (Lemon Squeezy)

If you use a license key without signing in, the extension sends the license key and, when needed, an activation instance ID to Lemon Squeezy over HTTPS to validate, activate or deactivate the license. A new activation uses a randomly generated name, not a hardware identifier or device fingerprint.

The response from Lemon Squeezy may include license status, expiration, store, product and order identifiers, and customer details such as name and email. The extension keeps only the license key, instance ID, plan identifiers, expiration and verification times needed to manage access. It does not save names, email addresses or order details in its local license record or use them for marketing.

1-4 Chrome sync storage (3.8.x records and license key backup)

For trials started in 3.8.x, the start time is also stored in Chrome sync storage so that reinstalling does not restart the trial. When updating from a version before 3.8, the extension reads the legacy license key from Chrome sync storage and activates it once; if no activation is free, the start of a 30-day grace period is stored in Chrome sync storage under a one-way hash of the license key, not the key itself. Whether these records sync across devices depends on your Chrome sync settings.

License key backup: after a license key is activated successfully, the extension stores a copy of the key itself in your Chrome sync storage — only the key, no name, email or other data; a key already in use when you update from an earlier version is backed up as well. When you reset your computer, switch computers or reinstall the extension, if Chrome is signed in to the same account and this computer has no license record, the extension automatically verifies and activates that key with Lemon Squeezy (this uses one activation; if none is free, the same 30-day grace period applies). The backup is deleted when you deactivate the license on this computer, or when the key is confirmed disabled, refunded or expired; however, if another computer signed in to the same Chrome account is still using this key, that computer will save the backup again later. Chrome sync storage is kept by Google according to your Chrome sync settings; you can also clear synced data in Chrome's settings.

2. Google sign-in (required for new users to start the trial or buy)

When sign-in is needed: for new users, to start the 7-day free trial or to buy a download plan or AI pack; to use the AI advisor; to keep notes with your account; or to use your license on another computer without re-entering the key. Existing customers who already use a license key do not need to sign in and can keep downloading with the key. Scanning, previewing and selecting media do not require sign-in.

How sign-in works: when you press "Sign in with Google" or "7-day free trial & download", the extension asks Chrome for the optional identity permission and opens Google's account chooser. Sign-in is handled by Google and Firebase Authentication (Google's sign-in service). We never see your Google password.

What we receive: only basic Google profile data (openid, email, profile): your Google account ID, email address, name and profile photo URL (the photo URL is kept only by Firebase Authentication, not in our database). We do not read your Gmail, Drive, contacts or any other Google data.

Where it is stored:

• Firebase Authentication keeps your sign-in account: Google account ID, email address, whether the email is verified, name, profile photo URL, creation time and last sign-in time. According to Google, Firebase Authentication runs only in US data centers, so this data is processed in the United States; for security and abuse prevention it also logs the network address and browser information used to sign in, kept for a few weeks.
• Our database is Google Cloud Firestore, located in Taiwan (asia-east1). Only our server can read or write the database; the extension and websites cannot access it directly.

What we store and why:

We review a monthly account-usage report (for example, more than 10 computers in the last 30 days, use from 3 or more countries, or several accounts starting trials on the same computer). The report does not block accounts automatically; we decide case by case whether to contact you.

3. Linking your license key to your account

Each time you sign in on a computer, and when you enter a license key while signed in, the extension sends that computer's license key to our server. The server only validates it with Lemon Squeezy (it does not activate it, so no activation slot is used), confirms it belongs to our product, and links it to your account.

• Our server stores: a hash of the key (used as the record ID), the encrypted key (AES-256-GCM; the encryption key is kept in Google Secret Manager), the last 4 characters, plan type, product and variant IDs, license status, expiration, link time, and an append-only history of links and unlinks (used to fix a key linked to the wrong account).
• Backup license key: when your account has an active download license, the server decrypts that key and sends it back to the computer you are signed in on, where it is stored. If our server is temporarily unreachable, the extension uses it to check the license directly with Lemon Squeezy (validation only, no activation). It is removed when you sign out.
• Our server re-checks the key's status with Lemon Squeezy at most once every 24 hours, sending only the key.
• Each license key can be linked to one account only. To move it, use the "Support" button to write to us; we will verify your purchase first.

4. Free trial

The 7-day free trial starts with a Google account, and each Google account can use the trial only once. The start and end times are set by our server's clock.

• Our server stores: a code derived from your Google account ID (computed with a key kept only in Google Secret Manager; without that key nobody can tell whose code it is), the trial start and end times, its source (started in 4.0, carried over from 3.8.x, or granted by support), your account ID, and the random ID of the computer that started the trial. No email address or network address is stored.
• This computer keeps a copy of the trial end date, so you can keep downloading until that date even if our server is temporarily unreachable.
• Updating from 3.8.x: the first time you sign in, this computer's original trial start time is saved to your account (this can only make the trial end earlier, never longer). It is carried over only once per computer, even if a different account signs in later.
• After you delete your account data: to prevent repeated trials, we keep the code above together with the trial start and end times and source; your account ID and the computer ID are deleted. If the same Google account signs in again after deleting its data, it still counts as "trial already used".

5. Product note sync

Without sign-in, notes stay only on your computer. After you sign in, notes are stored on our server so you can see them on other computers.

• What is synced: product platform and ID, product URL, product title, your own product name, purchasing status, notes, supplier name and link, variant mappings (variant names, variant image addresses, your own SKU codes and names), the media list (image and video addresses) and the time the page was read; plus the other version of a note kept when two computers changed the same note. The server also records a revision number, update time and the random ID of the computer that last updated it.
• When it syncs: right after sign-in, when you open the side panel, a few seconds after you save a note, and every 10 minutes while the side panel is open.
• Supplier details are what you enter yourself; please do not enter other people's personal data (for example, an individual supplier's phone number or address).
• When you delete a note, the server keeps a "deleted" marker for 90 days so your other computers also remove it; it is then cleared automatically.
• When signing out, you can tick "Also remove the notes on this computer" (notes in your account are not deleted). Deleting your account data deletes the notes on our server; you are asked separately whether to clear the notes on this computer.

6. AI e-commerce advisor

The AI advisor requires Google sign-in and is offered only in regions where the AI services we use are available (see section 8). Each account gets 5 free questions; after that you can buy AI packs (see section 9).

6-1 What is sent with each question

• Your question (up to 1,000 characters) and the text of the last 6 rounds of conversation.
• A product summary (not sent, and no images are sent, if you turn off "Use this product" on the product card): platform, product ID, title, the price text shown on the page, variant names (up to 40), media counts by type, and the time the page was read.
• Product images you choose to attach (up to 3 per question).
• Your interface language and target market.
• Your AI memory (only if you agreed to it and it is turned on, see section 7).

Not sent: cookies, Taobao or Google sign-in data, browsing history, license keys or URL parameters.

6-2 How it is processed

Our server first uses a small Gemini model to classify the question (questions unrelated to e-commerce are declined and not counted), then passes it to Anthropic's Claude or Google's Gemini to answer: we normally use one of them; if that one has a temporary problem before it starts answering, the other automatically answers the same question. When current information is needed (for example, current rules or exchange rates), the answering AI searches the web: Claude uses Anthropic's web search (the search terms are sent to Anthropic and the search provider it engages), and Gemini uses Google Search. The search terms are generated by the AI from your question and may include words from it; sources are shown with the answer. Calculations such as costs and shipping are done on our server. Exchange-rate sources: for New Taiwan dollars, Bank of Taiwan board rates (https://rate.bot.com.tw/xrt ); for other currencies (currently Malaysian ringgit, Singapore dollars, Japanese yen and Philippine pesos), the euro foreign exchange reference rates published daily by the European Central Bank (https://www.ecb.europa.eu/stats/policy_and_exchange_rates/euro_reference_exchange_rates/html/index.en.html ); the European Central Bank publishes no rate for the Vietnamese dong, so for dong only the rate you give is used. If you give an exchange rate in your question, we use yours first; if no rate can be obtained, you will be asked for one. Only public exchange-rate data is read, and none of your data is sent to the Bank of Taiwan or the European Central Bank. Rates are for reference only and are not actual transaction rates.

6-3 What we do not store

Our server does not store the content of your questions, answers or images. Images are only checked for format and size in the server's memory and then sent to the answering AI service; they are not saved as files. We do not accept image URLs.

6-4 Usage records we keep (deleted automatically after 180 days)

One record per question: time, outcome (answered, off-topic, error, etc.), whether a free question or which AI pack was used, market, number of images, number of tool and search uses, model name, token usage, cost, response time and error type. We use these to count questions, verify refunds, troubleshoot and estimate costs.

6-5 Conversation history stays on your computer

The full conversation is stored on this computer, one thread per product, for up to 30 days, and you can delete it with "Clear this conversation".

6-6 How Google Gemini handles your data

We use the paid Gemini API service, and Google processes the data under its terms. Under the Gemini API terms, prompts and responses from the paid service are not used to improve Google's products; Google logs prompts and responses for a limited period of time, solely to detect and prevent violations of its usage policies and for any required legal or regulatory disclosures. When the Google Search feature is used, Google stores prompts, the context we provide and the output for 30 days to create search-grounded results and search suggestions, and may use them for debugging and testing that feature. This data may be stored temporarily or cached in any country where Google has facilities. Gemini API terms: https://ai.google.dev/gemini-api/terms

6-6-1 How Anthropic Claude handles your data

We use the paid Anthropic API service, and Anthropic processes the data under its commercial terms. According to Anthropic's published information, prompts and responses are deleted from Anthropic's systems within 30 days; if automated systems flag them as violating the usage policy, prompts and responses may be kept for up to 2 years; retained data is not used to train models without our explicit permission. When web search is used, the search terms are sent to the search provider Anthropic engages. This data may be processed in the United States or other countries where Anthropic operates. Anthropic privacy information: https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data

6-7 Limits

AI answers are for reference only and are not legal, tax or financial advice for your specific case. The AI features are not offered to anyone under 18.

6-8 Ask AI to sort them (general mode)

After you press "Grab everything" on a site that has no fast lane yet, or when the fast lane for Taobao, Tmall, Tmall Global, 1688, AliExpress or Alibaba.com can't read a page and you grab everything instead, you can press "Ask AI to sort them" to have AI sort the grabbed pictures into main, variant, description and other images. As with the AI advisor, you need to sign in with Google, and it is offered only in regions where Gemini is available (see section 8).

• What is sent: only when you press the button. The page's domain (for example www.example.com, without the path or parameters of the address), the page title (up to 200 characters) and the text on option buttons (up to 40, each up to 30 characters); and one line per picture (up to 150 pictures): its number, size, the last part of its file name (up to 60 characters, with everything after a question mark or # removed), alt text (up to 120 characters), which part of the page it is in, the short text next to it (up to 60 characters) and its position in a group. When our server receives the list, it removes anything that looks like a web address before sending it to Gemini.
• What is not sent: the pictures themselves, the full addresses of the pictures or the page, the whole web page, cookies, sign-in data or license keys.
• How it is processed: our server sends the list to a small Gemini model, which only answers which numbers are main, variant (with the variant name), description and other images; Google Search is not used. The sorted result stays only in your side panel and is gone when you close it.
• Credits: each press uses 1 AI credit; nothing is used if sorting fails, or if you press again on the same page within 24 hours. Sorting when the fast lane can't read a page (emergency AI) is paid by us and uses none of your credits, up to 10 times per account per day.
• We do not store the content of the list. We keep only: when a credit is used, one usage record like the one in 6-4 (time, result, free credit or which pack, number of pictures, model name, usage, cost, response time, error type; deleted automatically after 180 days); to avoid charging twice for the same page, a one-way code calculated from the list and the time (deleted automatically after 24 hours); and how many emergency sorts you used today (deleted automatically after about 2 days). The document names of these two counters are a code calculated from your Google account ID with a key kept only in Google Secret Manager.
• Google Gemini handles the data in the same way as described in 6-6.

6-9 AI photo touch-up

You can have AI tidy up and polish a product photo (one from the download screen, or one you upload from your computer): a white or clean background, better lighting, and the ratio your marketplace wants. As with the AI advisor, you need to sign in with Google, and it is offered only in regions where Gemini is available (see section 8). The first time you use it, we remind you to use photos your supplier has allowed or that you have the right to use.

• What is sent: only when you press "Touch up", one photo at a time. Before sending, the extension redraws the photo on your computer as a JPEG (up to 2,048 pixels on the long side), so information stored in the photo, such as when and where it was taken, is not sent; the file name is always image.jpg, not your original file name. We also send only the options you picked (white background, clean scene or lighting only, the kind of scene), the ratio and the size.
• What is not sent: the photo's web address, the product page address, product data, cookies, sign-in data or license keys.
• How it is processed: our server checks the format and size (up to 7 MB) in memory only, then asks a small Gemini model whether the photo has a watermark, shop name, web address or contact details. If it does, the photo is not touched up (we do not remove watermarks) and no credits are used. If not, a Gemini image-editing model touches it up and the result is sent straight back to your side panel; Google Search is not used. The touched-up photo stays only in your side panel and is gone when you close the panel or sign out, so download it first.
• Credits: a standard (1K) photo uses 3 AI credits and a high-quality (2K) photo uses 4. Nothing is used if the touch-up fails or the photo is refused because of a watermark. To prevent heavy use, each account can touch up at most 4 photos a minute.
• We do not store the original or the touched-up photo. We keep only one usage record like the one in 6-4 (time, result, free credits or which pack, how many credits, size, the option picked, model name, usage, cost, response time, error type; deleted automatically after 180 days).
• Google Gemini handles the data in the same way as described in 6-6.

7. AI memory (optional; you are asked before first use)

If you agree, after each answer the AI picks out business background that will be useful later and saves it to your account. It is sent to the answering AI service (Anthropic Claude or Google Gemini) with your next questions so you do not have to repeat yourself. It is used only to make your AI advisor's answers fit you better.

• What it remembers: the five "My shop" fields (selling platforms, main categories, target markets, pricing habits and business stage), plus "What AI remembers": frequently asked questions, working habits and preferences, key points from past conversations and other business facts, one sentence per item (up to 100 characters each and 50 items in total, of which at most 15 are key points from past conversations). Each item records its content, category, source (saved by the AI or written by you), creation and update times, when it was last used, and a date; items saved by the AI also record which question they came from (used for undo). We also record whether memory is on or off, and when and to which version of the consent text you agreed.
• What it does not remember: we instruct the AI not to save ID card, passport, residence permit or health insurance card numbers; bank account or card numbers or payment details; passwords, verification codes, keys, cookies or sign-in credentials; anyone's (including your own, your buyers' or your suppliers') address, phone number, email or LINE / WeChat account; buyer details and order details; health, religion, political views, sexual orientation, ethnicity, criminal records or union membership; personal finances; any location more specific than a country; data about minors; anything read from product pages, images or search results; one-off information (such as this question's exchange rate); or anything phrased like an instruction. The product categories you sell do not count (for example, "sells health supplements" can be saved). Our server also checks every item the AI saves against automatic rules: anything that looks like a card number, ID or residence permit number, email address, phone number, street address, bank account, long string of digits, password or key, URL containing credentials, LINE or WeChat account, or an instruction is discarded as a whole; we keep only the number of discarded items, not their content. What you type yourself goes through the same check; if it matches, it is not saved and you are asked to rephrase it.
• To extract memory, our server sends today's date, your current "My shop" and memory list, that question and the first 600 characters of the answer to Gemini to decide what to remember; product data and images are not sent. This happens only when the question was answered successfully, and it does not use a question from your quota. The AI usage record (section 6-4) also notes whether memory was included in that question, the cost of the extraction, and how many items the AI changed or deleted (numbers only).
• Each time something is saved, changed or deleted, it is shown below the answer ("Remembered: …", "Changed: …", "Forgot: …") with an "Undo" button. Undo deletes what that answer newly saved. What that answer changed or deleted may not be recoverable if more than 24 hours have passed, 10 or more later questions saved memory, you have since edited or deleted those items yourself, or you used "Delete all". When something cannot be recovered, the extension tells you so and shows the original text so you can decide whether to add it back.
• To make undo possible, the earlier versions of items the AI changed or deleted are kept in an "undo record", which is deleted automatically 7 days after the AI last changed your memory. When you edit or delete an item yourself, that item's earlier version is also removed from the undo record.
• In "AI memory" you can view, edit, delete, add your own items, delete everything or turn memory off at any time, and you can fill in or edit "My shop" directly; you can tidy up and delete even while memory is off. When it is off, the AI reads and writes nothing; when turning it off you can choose to keep or delete everything. "Delete all" deletes "My shop", all items and the undo record. Deletion is permanent.
• If you choose "Not now" the first time you ask the AI, memory is turned off and you are not asked again; if you agreed and the consent text later changes materially, you will be asked again.
• Key points from past conversations saved by the AI are deleted automatically if not used for 180 days. Items saved by the AI may also be rewritten or deleted by the AI (for example, when they are out of date); when memory is full (50 items, or 15 key points from past conversations), the AI item that has gone unused the longest is replaced by the new one. Items you wrote or edited yourself are never changed or deleted by the AI and are never deleted automatically. Everything else is kept until you delete it, choose to delete it when turning memory off, or delete your account data.
• "Download my data" includes all of your AI memory (including the on/off and consent records and the undo record); "Delete account data" deletes all of it. When our support team looks up an account, they can see only whether memory is on and how many items there are, not the content.

8. Region check using your network address (only to decide whether AI is available)

Google Gemini and Anthropic Claude are each available only in the countries and regions on their official lists. We offer AI features only in regions where all the AI services we normally use are available; when the other service answers instead, it does so only in regions where that service is available. We apply this strictly.

• When: every AI question and every AI pack checkout is checked again; after you sign in, the check also runs when the extension asks whether AI is available here (it does not ask when you are signed out). It also runs once at sign-in, only to record the last country of use for this computer (section 2).
• How: we use the network address (IP) you connect to our server from, look it up in DB-IP's country database stored on our server (your address is not sent to DB-IP), and compare it with the public list of Tor exit nodes. Our server downloads the Tor list from the Tor Project regularly; none of your data is sent.
• What is stored: our program does not store your network address. It stores only the resulting country code (or "Tor" / "unknown") and the time: in your account's computer records, in the record of the last 20 refusals, and in our server logs (see section 10). Google Cloud's own request logs do record network addresses (see section 10).
• When AI is not offered: if the region cannot be determined, Tor is used, you are in mainland China, Hong Kong or Macau, or the region is not on the official list of the AI services we use. Downloading is not affected.
• Limits: the check is based on network addresses and a small number of results may be wrong. Using a VPN, proxy or similar method to bypass regional restrictions violates the terms of use, and we may suspend AI for that account.
• Region data: IP Geolocation by DB-IP (https://db-ip.com ).

9. Payments (Lemon Squeezy)

• Download plans (monthly or lifetime) and AI packs are sold by us (EasyFlow Studio) through Lemon Squeezy; AI packs are not sold by Google. Buying opens a Lemon Squeezy checkout page, and payment, billing, tax and subscriptions are handled by Lemon Squeezy and its payment providers. Neither the extension nor our server can read your full card number, security code or payment-account password. Lemon Squeezy's privacy policy: https://www.lemonsqueezy.com/privacy
• Starting the 7-day free trial does not require a card and does not create a paid subscription.
• AI packs: a one-time payment, not a subscription, with no automatic charges; the questions are added to your Google account and do not expire.
• Buying: new users must sign in with Google before buying a download plan or AI pack. When you buy while signed in, the checkout link carries your account ID so the license key or questions you buy are added to your account automatically. A download plan's license key is linked to your account as described in section 3 (validated only, not activated).
• Payment notifications: when a payment or refund is completed, Lemon Squeezy notifies our server with the order number, product, amount, purchase time, purchase email and the account ID carried in the checkout link. We use this to add questions or license keys to your account. Each AI pack is stored as one record in your account: order number, number of packs, questions granted and remaining, purchase time, refund deadline and refund status. If an order cannot be matched to an account (for example, the checkout link did not carry an account ID), it is held as "unclaimed" together with the purchase email so support can verify it and add it to your account; the email is deleted once the order is added to an account or fully refunded. We also keep a processing record containing only the order number, event and result, so that the same payment is not processed twice.
• AI pack refunds: a completely unused pack can be refunded from the account page within 14 days of purchase (up to 2 refunds per account per year), and its questions are removed when refunded. A pack that has been used even once cannot be refunded. For a refund, our server sends the order number to Lemon Squeezy to request the refund and to check its result.
• Monthly download subscriptions can be cancelled by you under "Manage / cancel subscription" and remain active until the end of the current period. When you use this button while signed in, our server uses the order number of the monthly license key linked to your account to find your subscription at Lemon Squeezy and opens your personal subscription management page (provided by Lemon Squeezy); it also records the subscription ID, renewal status and dates to show on the account page. If you are not signed in, or the subscription cannot be found, Lemon Squeezy's general subscription management page opens and you sign in there with your purchase email. Deleting your account data or deactivating a local license does not cancel a subscription, issue a refund or delete Lemon Squeezy's transaction records.
• Switching from monthly to lifetime: when you buy a lifetime license while signed in and the payment goes through, our server finds your ImportMate monthly subscription the same way (the order number of the monthly license key linked to your account) and asks Lemon Squeezy to cancel it. You are not charged again, the monthly plan stays active until the end of the current period, and the rest of that period is not refunded. We only cancel the ImportMate monthly download subscription and never touch other subscriptions. If it can't be cancelled automatically, the extension reminds you to cancel it yourself under "Manage / cancel subscription".

10. Server logs

• Google Cloud request logs: each time the extension connects to our server, Google Cloud automatically records a request log including your network address, time, requested URL, response status, processing time, data size and browser information, kept for 30 days and then deleted automatically. These are used for troubleshooting and security.
• Our own program logs: they do not record network addresses, email addresses, sign-in tokens, license keys, or the content of questions and answers; they record only event types, results, country codes, processing times and usage numbers, and, like the request logs above, are deleted automatically after 30 days.
• Support action records: when we handle support (for example, moving a license key, granting a trial, adding AI questions or suspending AI), we record what was done, when and why, without license keys or network addresses.

11. Optional anonymous notices

When a scan finds that a section of a product page could not be read (for example, the page shows variant pictures but none were found), the side panel may ask whether you want to notify the developer anonymously. Only if you press "Notify" does the extension send one short notice to a Google Apps Script web app operated by us. It contains only the extension version, the platform (Taobao, Tmall or Tmall Global), the affected media category, a fixed problem code, up to 20 code names of the page sections involved (the stable part of the page's own CSS class names, such as "skuItem"), and the date. It does not contain the product URL, product ID, product title, license key, cookies, picture addresses or any account information, and it is sent without cookies. You can expand "What is sent?" to see the exact content first; pressing "No thanks" sends nothing. Notices are stored in our Google spreadsheet, used only to detect and fix page-layout changes, and deleted automatically after 12 months.

12. Support

The "Support" button at the top right of the side panel opens a support window. "Email support" opens a Gmail compose window with a technical report in the message; nothing is sent until you press Send in Gmail yourself. If the report is too long, only a summary or no report is included and you are asked to attach the report file instead. You can also copy the support address and attach a file saved with "Download report".

The report contains the extension version, platform, media counts, scan duration, queue and download counts, output settings, fixed error and page-layout codes, and any optional answers you choose. It excludes product titles, URLs, IDs, cookies, license keys, API keys and raw error messages. The extension never sends or uploads it automatically.

If you email us, we use your email address, message and attachments to respond. Support emails have no fixed retention period; we delete them when you ask us to. Do not send card details or account passwords.

13. Who receives your data

The Tor Project, DB-IP, the Bank of Taiwan and the European Central Bank are only sources from which we obtain public lists, database files or exchange rates; they receive none of your data.

We do not sell user data or use it for personalized advertising, unrelated profiling, credit ratings or lending decisions. Our use of user data complies with the Chrome Web Store User Data Policy, including its Limited Use requirements.

14. How long data is kept

15. Your rights

Download my data: after signing in, press "Download my data" on the account page to download a file containing your account data (email, name, creation and last-use times, download license summary, AI quota, region-refusal records), each computer's record, synced notes, AI memory, AI pack records, a license summary (last 4 characters, plan, status and link time only, not the key itself), trial status and the total count of AI usage records.

Delete account data: when you press "Delete account data" on the account page, we:

1. First invalidate the account's sign-in.
2. Delete everything under your account: computer records, synced notes, AI memory, AI quota and pack records, region-refusal records, and AI usage records.
3. Delete your Firebase sign-in account.

To prevent repeated trials and repeated use, the following are kept, but none of them remain connected to your account:

• The trial code, trial start and end times and source (section 4).
• Free AI questions already used: only a code derived from your Google account ID, the number used, and the time it was updated, kept with no time limit (if the same Google account signs in again after deleting its data, it does not get the free questions again).
• License key links are marked "released", keeping only the key's hash, plan type and release time; your account ID is removed from the link history and from support action records.
• Attempt counters, deleted automatically within about 2 days after the last attempt.

Automatic deletion after long inactivity: if your account is not used for more than 6 months (no sign-in, and no opening the extension, syncing notes or using the AI while signed in), we automatically delete your account data in the same way as above, keeping only the items listed above. Accounts with unused paid AI questions or a valid download license key (lifetime or monthly) are not deleted automatically.

In addition: Google Cloud request logs are deleted when they expire (section 10); Lemon Squeezy keeps transaction records under its own policies and the law; unclaimed AI pack orders keep their order number and contents so support can grant or refund them, and for those whose checkout link carried your account ID, the purchase email and account ID are deleted; support emails you sent are not deleted by this action (ask us separately if you want them deleted); and you are asked separately whether to clear the notes on this computer. Deleting your account data does not cancel a monthly download subscription; to stop payments, use "Manage / cancel subscription" or the link in your purchase confirmation email.

Correction: notes and AI memory can be edited directly in the extension. Your email and name follow your Google account and are updated the next time you sign in.

Withdrawing consent: you can turn off AI memory, sign out or stop using the AI at any time.

Other requests: for other requests to access, correct, delete or download your data or withdraw consent, write to us through the "Support" button. Records we are legally required to keep may need to be retained.

16. Security

• The extension always uses HTTPS to communicate with our server and Lemon Squeezy.
• Only our server can read or write the database; the extension and websites cannot access it directly.
• License keys are stored encrypted; trial records use codes that do not reveal who you are; all secret keys are kept in Google Secret Manager, not in the extension or code.
• The extension does not contain administrative payment-service API keys.
• Data on this computer also depends on the security of your device, operating-system account and Chrome profile.

17. Changes to this policy

When our data handling changes, we will update this policy and the date above; material changes will be disclosed appropriately in the extension or on the store page.

18. Contact

For privacy questions or requests to view or delete your data, use the "Support" button at the top right of the extension's side panel.