Privacy Policy

1. Operator and contact details

This website uses the ShinoX brand. The name of the company or person responsible for operations, and the designated privacy-rights contact, remain to be confirmed. The brand name is not presented as a verified legal entity.

The telephone number and email below are the website service contacts currently verified. You may use this service email for questions about data use or rights requests; the designated responsible contact and handling procedure remain to be confirmed.

2. Current service status and scope

The current private review site provides equipment information, business solutions and contact links. Online enquiry and equipment-visit forms remain disabled and will not collect real personal data before policy and form acceptance is complete. Do not enter real customer information in acceptance tests.

This policy describes current website behavior and distinguishes backend features that are not enabled. When you contact us directly by email, telephone, LINE or WhatsApp, the relevant platforms also process data under their own terms and policies.

3. Form fields and data sources

The form is designed to request a name, telephone number, email address, location, enquiry subject and message. Equipment-visit enquiries additionally include a preferred location, date and time. Do not provide identity documents, financial account information, health data or other sensitive information unrelated to the enquiry.

If the feature is enabled following acceptance, the system will record a request ID, receipt time, privacy-policy version, the consent time reported by the browser and the server recording time. Browser-reported and server-recorded times are kept separately; the former is not treated as server-verified time.

The current code does not automatically transmit unsubmitted form contents to the backend. The website does not request browser access to location, camera or microphone permissions.

4. Purposes and processing

Once forms are enabled, data will be used to answer the equipment, site-development or visit enquiry, clarify requirements, arrange personal contact and manage the request as necessary. Submitting an enquiry does not establish an order, franchise agreement or confirmed visit.

The enquiry-consent checkbox is not preselected and does not include marketing subscription. Newsletters, automatic marketing lists and marketing email are not enabled. Any future addition must be explained separately and offered as an independent, voluntary choice.

5. Database, notifications and management access

The private review site currently uses Sites static hosting and ChatGPT sign-in access control. No database service capable of accepting enquiries is deployed. Website code does not read your ChatGPT profile. Hosting and sign-in platforms may process connection and authentication information under their own policies; their log fields, processing locations and retention periods require provider confirmation.

Separate Python backend code, not deployed as a live service, uses a SQLite database on private storage for enquiries and a notification outbox, with notifications sent through SMTP. Configured recipients include the website service mailbox and an owner-designated management mailbox. The actual SMTP provider, hosting location and authorized management list remain to be confirmed.

The backend includes management-token authentication, CSV export and an offline database backup script. These are code capabilities, not evidence of configured production administration, backup or email services, nor of any security certification or absolute security guarantee.

6. Retention and deletion

The backend currently configures database cleanup after 30 days. This is a technical setting awaiting operational approval, not an approved production retention policy. In production mode, the cleanup worker checks for expired records approximately every 60 seconds.

Sent email copies, administrator-exported CSV files and backups are not automatically deleted when database records are removed. Production database retention, email and backup retention and rotation, deletion procedures and any legally required exceptions must be confirmed and reflected in this policy before intake is enabled.

7. Cookies, storage and tracking tools

A review of the current website code found no enabled Google Analytics, Google Tag Manager, Meta Pixel, other advertising trackers, cross-site tracking cookies or application-set cookies.

The homepage campaign popup uses sessionStorage to remember whether the campaign has been seen in the same tab, solely to avoid repeated display. It does not store form names, telephone numbers or email addresses. This browser-managed storage normally ends with the tab session. Necessary cookies or records belonging to the hosting and sign-in platforms are outside what can be verified from website code.

8. External services and cross-platform contact

The site links to LINE, WhatsApp, Facebook, YouTube, email and external investment calculators. After you follow a link, that service handles information you provide there. The current website does not automatically send enquiry-form data to those tools. YouTube is linked as an external channel rather than an automatically loaded embedded player.

Third-party services may process data in different countries or regions. Their processing locations, retention and rights procedures are governed by their policies. Unconfirmed production processors and cross-border arrangements remain on the pre-intake confirmation list.

9. Data rights and requests

You may use the service email below to request access, inspection, copies, supplementation or correction, cessation of collection, processing or use, and deletion. Describe the request and a contact method. Do not send identification documents or sensitive information unrelated to verifying the request.

The designated handler, necessary identity-verification method, response times and any lawful grounds for retention remain to be confirmed. Before intake is enabled, the operator must establish workable rights-request and deletion procedures.

10. Items required before enabling intake

To be confirmed: the company or person responsible for operations; privacy-rights contact; database host and processing location; SMTP and notification providers; administrator permissions; database, email and backup retention; deletion and rights procedures; and owner acceptance of the policies and forms.

Until those details are confirmed and accepted, website forms and intake APIs remain closed. Policy updates will show their version and date; any future purposes requiring renewed confirmation will be explained before submission.