Personal & Emotional Data Protection Statement

Last updated: July 8, 2026 · Effective: July 8, 2026 · Applies to: MuLanXu® entire platform · Headquarters: Mulanxu HQ, Building A6, Canal Vanke Center, Gongshu District, Hangzhou

This statement supplements the Privacy Policy on the dimension of "emotional data". MuLanXu® is an AI relationship growth platform. Emotional relationship information, intimate relationship descriptions, psychological self-statements, and conversation content are sensitive personal information. The platform adopts the most rigorous protection strategy: separate consent, minimum necessary, encrypted storage, strict access control, default domestic storage.

Core principle: Emotional data may be processed only after the user has given separate consent; users may withdraw consent, delete data, export copies, and opt out of training use at any time. No emotional data is collected from minors.

1. Legal Basis

Personal Information Protection Law of the People's Republic of China (PIPL)
Data Security Law of the People's Republic of China
Cybersecurity Law of the People's Republic of China
Interim Measures for the Management of Generative AI Services
Interim Measures for the Management of Anthropomorphic AI Interaction Services (effective July 15, 2026)
Measures for Standard Contract for Cross-border Transfer of Personal Information
GB/T 35273 Information Security Technology — Personal Information Security Specification

2. Emotional Data = Sensitive Personal Information

Scope: The following data are all managed as sensitive personal information and require separate consent before processing:

Emotional relationship information: intimate relationship descriptions, dating status, marital status, relationship satisfaction, emotional tendencies toward partners
Conversation content: user-to-AI and user-to-user conversation records, text, voice, images (emotion-related)
Relationship preferences: value orientation, partner preferences, relationship style, communication patterns
Psychological self-statements: user-input statements on depression, anxiety, stress, insomnia, family conflict, intimate relationship distress
Behavioral traces: offline activity participation, geolocation check-ins, club visit records
AI reports: AI-generated personality portraits, relationship matching advice, emotion recognition reports, risk identification records
Crisis signals: self-harm, suicide, violence tendencies revealed in user conversations

3. Separate Consent Mechanism

Emotional data processing is not bundled with basic account services. If the user refuses separate consent, they can still browse, view public content, and learn about the brand, but cannot use AI relationship companion, AI reports, and matching core services.

When first enabling AI chat: separate pop-up disclosing emotional data scope, retention period, use, and withdrawal rights
When first generating an AI report: separate pop-up disclosing data use for portrait modeling, report generation, training opt-out
When first uploading emotional content: separate pop-up disclosing encrypted storage, deletability, exportability
Processing only starts after the user clicks "Agree"; if the user clicks "Disagree", it is not mandatory, related functions are merely closed

4. User Rights and How to Exercise Them

Right to access: view types, sources, uses, retention periods of emotional data collected — via "My - Data Query"
Right to correction: correct inaccurate emotional portraits, relationship preferences, personal information — via "My - Profile"
Right to deletion: delete all chat records, delete a single AI report, delete account — via "My - Data Management"
Right to withdraw consent: separately withdraw "emotional data processing consent", "AI training data use consent", "personalized recommendation consent" — available at any time
Right to data copy: export all personal data (JSON/PDF), delivered via email or download link within 10 business days
Right to account cancellation: data deletion completed within 30 days after account cancellation, except for logs required by law
Right to complain: complain to pr@mulanxu.com, or to the Cyberspace Administration or Market Regulatory Authority

5. Data Use Rules

Minimum necessary: only collect emotional data necessary for specific functions, no over-collection
Purpose limitation: emotional data is used only for relationship style portrait, AI conversation context, AI report generation, risk identification, not for secondary marketing, cross-platform portrait, third-party advertising
No cross-border transfer: emotional data is entirely stored within mainland China, not transferred abroad or to overseas entities
Not sold to third parties: under no circumstances are emotional data sold to third parties
No mandatory training: users may at any time turn off "Allow for AI model training"; once off, the data does not enter any model training pipeline
No mandatory recommendation: users may at any time turn off "Personalized recommendation"; once off, only non-personalized content is shown

6. Data Retention Periods

Chat records: default 12 months; users can manually delete at any time; cleared from production within 7 days after deletion
AI reports: default 24 months; auto-deleted upon expiry; users can delete earlier
Relationship portraits: continuously updated during account validity; deleted upon account cancellation
Crisis intervention records: permanently retained per safety/compliance requirements (anonymized), for improving crisis detection algorithms
Audit logs: retained at least 6 months per Interim Measures for Generative AI Services
Legal hold: event-related data subject to litigation or regulatory investigation is extended per legal requirements

7. Special Protection for Minors

Strictest strategy: This platform does not provide to users under 18 years old any emotional matching, virtual companion, intimate relationship advice, or offline activity recommendation services, and does not collect emotional data from minors.

Date of birth is verified at registration; under-18 users cannot activate emotion-related functions
If a suspected minor is identified, immediately stop emotional data collection and prompt for guardianship
A small amount of consultation data submitted by minors is auto-deleted within 15 days
Parents or guardians may apply for permanent deletion of all data of their children on this platform

8. Technical Data Security Measures

Transport encryption: TLS 1.3 end-to-end
Storage encryption: AES-256 at rest, with SM4 dual-track encryption
Access control: role-based minimum permission (RBAC) with dual review
Anonymization: R&D, testing, and audit scenarios all use anonymized data
Auditing: all data access, modification, export, deletion fully logged, traceable to specific persons and time
Disaster recovery: same-city dual-active + off-site DR, RPO ≤ 5 min, RTO ≤ 30 min
Third-party audit: annual third-party security audit; summary published no later than Q1 of the following year

9. Third-Party Sharing List

The platform does not sell emotional data to third parties; sharing occurs only in the following minimum necessary scenarios:

Domestic AI large models: only desensitized conversation content is transmitted for AI generation; no identity info or emotional portrait labels
Payment channels: only order number and payment status are shared upon payment; no emotional data
SMS / email service providers: only phone number / email is shared for verification codes, notifications, and reports
Cloud providers: Alibaba Cloud / Tencent Cloud / Huawei Cloud domestic nodes, no cross-border
In the event of merger, acquisition, or reorganization, emotional data is transferred under the same protection standard; if no longer protected, 30 days prior notice with opt-out option is provided

10. Cross-Border Data Risk Statement

Zero cross-border commitment: MuLanXu® uses only 12 domestic AI large models (ERNIE, Qwen, Doubao, Hunyuan, GLM, Kimi, Baichuan, DeepSeek, SenseChat, Yi, Spark, Pangu). User emotional data is 100% stored within mainland China, with no cross-border data risk.

11. Updates to This Statement

This statement may be updated according to legal/regulatory changes and product evolution
Material changes will be notified 15 days in advance via in-app notification, email, and SMS
If the user disagrees with the change, they may export data and delete the account before effective date
Historical versions are available in the footer "Document History"

12. Contact Us

Data Protection Officer (DPO): pr@mulanxu.com
User rights requests: email pr@mulanxu.com (reply within 10 business days)
Data security incident report: email pr@mulanxu.com (7×24)
Mailing address: Mulanxu HQ, Building A6, Canal Vanke Center, Gongshu District, Hangzhou
Regulatory complaints: Cyberspace Administration of China (www.12377.cn); Zhejiang Provincial Cyberspace Administration; Zhejiang Provincial Communications Administration