Personal Information and Emotional Data Protection Statement
This statement supplements the Privacy Policy in the dimension of "emotional data."MulanXu® is an AI relationship growth platform. Emotional relationship information, intimate relationship descriptions, mental state self-reports, and communication content constitute sensitive personal information. The Platform applies the strictest protection strategy of "separate consent, minimum necessity, encrypted storage, strict access control, and no cross-border transfer by default" to such data.
Core Principle:Emotional data may only be processed after the user's separate consent. Users may withdraw consent, delete data, export data copies, and request to disable training use at any time. Emotional data of minors is not collected.
I. Legal Basis of This Statement
- Personal Information Protection Law of the People's Republic of China (PIPL)
- Data Security Law of the People's Republic of China
- Cybersecurity Law of the People's Republic of China
- Interim Measures for the Management of Generative Artificial Intelligence Services
- Interim Measures for the Management of AI Anthropomorphic Interaction Services (effective July 15, 2026)
- Measures for the Standard Contract for Outbound Transfer of Personal Information
- Methods for Identifying Illegal Collection and Use of Personal Information by Apps
- GB/T 35273 Information Security Technology — Personal Information Security Specification
II. Emotional Data = Sensitive Personal Information
Defined Scope:The following data is all managed as sensitive personal information and may be processed only with the user's separate consent:
- Emotional relationship information:intimate relationship descriptions, dating status, marital status, relationship satisfaction, and emotional tendencies toward a partner
- Chat content:conversation records, text, voice, and images (relationship-related) between users and AI or between users and real users
- Relationship preferences:values orientation, partner preferences, relationship style, and communication pattern profiles
- Psychological self-reports:user-initiated self-reported content such as depression, anxiety, stress, insomnia, family conflicts, and intimate relationship difficulties
- Behavioral trajectories:offline event participation, geographic location check-ins, and club visit records
- AI reports:AI-generated personality profiles, relationship matching suggestions, emotion recognition reports, and risk identification records
- Crisis signals:high-risk signals such as self-harm, suicide, or violent tendencies expressed by users in conversations
III. Separate Consent Mechanism
The processing of emotional data is not bundled with basic account services. If a user declines separate consent, they may still use MulanXu's basic browsing, public content viewing, and brand information features, but cannot use core services such as AI relationship companionship, AI reports, and relationship matching.
- When first enabling AI conversation:a separate pop-up informs you of the scope of emotional data, retention period, purposes, and your right to withdraw
- When first generating an AI report:a separate pop-up informs you that data is used for profile modeling and report generation, and that training use can be disabled
- When first uploading relationship-related content:a separate pop-up informs you that data is encrypted for storage and can be deleted and exported
- Processing begins only after the user clicks "Agree"; when the user clicks "Decline," no coercion is applied — only the relevant features are disabled
IV. User Rights and How to Exercise Them
- Right of access:view the categories, sources, purposes, and retention periods of collected emotional data — via "My - Data Query"
- Right of rectification:correct inaccurate emotional profiles, relationship preferences, and personal information — via "My - Profile Editing"
- Right of deletion:delete all chat records, delete individual AI reports, delete your account — via "My - Data Management"
- Right to withdraw consent:separately withdraw "consent to emotional data processing," "consent to AI training data use," and "consent to personalized recommendations" — available at any time
- Right to obtain a data copy:export all personal data (JSON / PDF format), delivered within 10 business days via email or a download link
- Right to request account cancellation:data deletion is completed within 30 days after account cancellation, except for logs required to be retained by law
- Right to complain and report:file a complaint with pr@mulanxu.com, or with the cyberspace administration or market regulation authorities
V. Data Use Rules
- Minimum necessity:only emotional data necessary to implement specific features is collected; no collection beyond scope
- Purpose limitation:emotional data is used only for relationship style profiling, AI conversation context, AI report generation, and risk identification; it is not used for secondary marketing, cross-platform profiling, or third-party advertising
- No cross-border transfer:emotional data is entirely stored within mainland China and is not transferred abroad or provided to overseas institutions
- No sale to third parties:emotional data is never sold to third parties under any circumstances
- No forced training:users may disable "Allow use for AI model training" at any time; once disabled, the data does not enter any model training process
- No forced recommendations:users may disable "Personalized recommendations" at any time; once disabled, only non-personalized content is displayed
VI. Data Retention Periods
- Chat records:retained for 12 months by default; users may delete them manually at any time, and deleted records are cleared from the production environment within 7 days
- AI reports:retained for 24 months by default and automatically deleted upon expiration; users may delete them manually in advance
- Relationship profiles:continuously updated while the account is active and deleted upon account cancellation
- Crisis intervention records:permanently retained (after de-identification) in accordance with safety and compliance requirements, and used to improve crisis identification algorithms
- Audit logs:retained for no less than 6 months in accordance with the Interim Measures for the Management of Generative AI Services
- Legal retention:data related to incidents involving litigation or regulatory investigations is retained for an extended period as required by law
VII. Special Protection for Minors
Strictest Strategy:The Platform does not provide relationship matching, virtual companion, intimate relationship advice, or offline event recommendation services to users under the age of 18, and does not collect emotional data from minors.
- Date of birth is verified at registration; relationship-related features are not enabled for users under 18
- If a suspected minor is identified, emotional data collection is immediately stopped and a guardianship notice is displayed
- Small amounts of inquiry-type data submitted by minors are automatically deleted within 15 days
- Parents or guardians may request the permanent deletion of all of their child's data on the Platform
VIII. Data Security Technical Measures
- Transmission encryption:TLS 1.3 end-to-end encryption
- Storage encryption:AES-256 encryption at rest, with dual-track SM4 national cryptography encryption
- Access control:role-based least privilege (RBAC) with dual-person review
- De-identification:de-identified data is used in all development, testing, and audit scenarios
- Auditing:all data access, modification, export, and deletion is fully logged and traceable to specific personnel and timestamps
- Disaster recovery:same-city active-active deployment plus remote disaster recovery, with RPO ≤ 5 minutes and RTO ≤ 30 minutes
- Third-party audits:an independent third-party security audit is conducted annually, with an audit summary published no later than the first quarter of the following year
IX. Third-Party Sharing List
The Platform does not sell emotional data to third parties and shares data only in the following minimally necessary scenarios:
- Domestic AI large models:only de-identified conversation content is transmitted for AI generation; identity information and emotional profile tags are not transmitted
- Payment channels:only order numbers and payment status are shared during payment; no emotional data is shared
- SMS/email service providers:phone numbers/email addresses are shared only when sending verification codes, notifications, and reports
- Cloud service providers:Alibaba Cloud / Tencent Cloud / Huawei Cloud nodes within China; no cross-border transfer
- In the event of a corporate merger, acquisition, or restructuring, emotional data is transferred under equivalent protection standards; if protection can no longer be maintained, users will be notified 30 days in advance and provided with an opt-out option
X. Cross-Border Data Risk Statement
Zero Cross-Border Commitment:MulanXu® exclusively uses 12 domestic Chinese AI large models (ERNIE, Qwen, Doubao, Hunyuan, Zhipu GLM, Kimi, Baichuan, DeepSeek, SenseTime, 01.AI, Spark, Pangu). User emotional data is 100% stored within mainland China, and there is no cross-border data risk of any kind.
XI. Updates to This Statement
- This statement may be updated in response to changes in laws and regulations and product evolution
- Material changes will be communicated 15 days in advance via in-app notifications, email, and SMS
- If a user does not agree to a change, they may export their data and delete their account before it takes effect
- Historical versions can be found in the "Document History" section of the footer
XII. Contact Us
- Data Protection Officer (DPO):pr@mulanxu.com
- User rights requests:email pr@mulanxu.com (response within 10 business days)
- Data security incident reporting:email pr@mulanxu.com (24/7)
- Mailing Address:MulanXu Headquarters, Building A6, Yunhe Vanke Center, Gongshu District, Hangzhou, Zhejiang Province
- Regulatory complaints:Illegal and Harmful Information Reporting Center of the Cyberspace Administration of China (www.12377.cn); Zhejiang Provincial Cyberspace Administration; Zhejiang Provincial Communications Administration