Privacy Policy
Updated: October 30, 2026
Zhejiang Shizai Intelligent Technology Co., Ltd. (浙江实在智能科技有限公司, hereinafter referred to as “we” or “Shizai Intelligence”) understands the importance of personal information to you. In strict accordance with laws, regulations and national standards, including the Civil Code of the People’s Republic of China, the Cybersecurity Law of the People’s Republic of China, the Data Security Law of the People’s Republic of China, the Personal Information Protection Law of the People’s Republic of China and the Interim Measures for the Administration of Generative Artificial Intelligence Services, we will adopt rigorous security safeguards to effectively protect your personal information and enterprise business data.
This Privacy Policy applies to the Soiawork enterprise-grade AI agent platform that we operate (hereinafter referred to as “Soiawork” or the “Service”), including, but not limited to, the Soiawork official website (soiawork.cn), the Web workspace (Desk), the desktop and mobile Soia Worker clients, open platform interfaces (API), and related services accessed through plugins and connectors (Connectors/MCP).
Before you begin using the Service, please be sure to carefully read and fully understand this Policy in its entirety, especially the provisions marked in bold or bold and underlined—these provisions concern your material interests or exempt us from liability. When you confirm your agreement or begin using the Service, you will be deemed to have acknowledged and agreed to this Policy. We endeavor to explain the technical terms in this Policy in simple, accessible language; if you have any questions about this Policy, you may contact us through the compliance contact channels published at the end of this document.
What Is Soiawork?
Soiawork is an enterprise-grade AI agent platform that helps enterprises easily build AI organizations and create their own AIOS. It brings AI into actual business operations, turning one-off, open-ended tasks into team task assets that are traceable, reusable, governable and subject to continuous optimization. Users use natural language instructions to drive AI Agents to autonomously plan and execute complex, multi-step business tasks, with cloud sandboxes and local Workers collaborating to deliver work, including, but not limited to, cross-system data collection, batch file parsing and processing, business analysis report generation, and automated store inspections and monitoring across multiple e-commerce platforms.
We support natural language reasoning through compliant third-party large models that have completed algorithm filing. You may submit input content (“Input”) through text, voice, files, instructions and other means; the system processes it and returns generated text, reports or automated execution actions (“Output”). You may also extend connections to business systems such as 钉钉, 飞书, 企业微信 and enterprise ERP through connectors and the MCP protocol.
Core Compliance and Data Security Commitments:
Absolute No-Training Principle: We solemnly commit that none of your Input, Output, conversation records, workflow configurations or vector Knowledge Base will ever be used for pre-training, fine-tuning or algorithm iteration of any model, whether independently developed or provided by a third party;
On-Device Privacy Protection: The local Worker client performs controlled file reading and writing only within allowlisted directories on your authorized local device. Critical system paths are blocked by default, and original file contents do not flow back to external servers;
Safe Use Recommendations: When assigning tasks to an Agent, please avoid actively entering unnecessary sensitive personal information unrelated to task execution (such as personal identity card numbers or proof of private assets).
What Information Do We Collect? (Overview)
| Information Category | Typical Personal Information / Business Data Included | Required? | Main Processing Purpose |
|---|---|---|---|
| Account and organization information | Business email address, mobile phone number, password/verification code, user ID, tenant organization identifier, nickname, avatar | Required | Creating, authenticating and maintaining the enterprise account system and tenant permissions |
| Task interaction data | User instructions, prompts (Prompt), uploaded files, Agent Output, conversation history | Required | Multi-step task planning, large model inference and delivery of task artifacts |
| On-device and Worker data | Device identifiers, operating system type, Worker online status, controlled operation summaries, local execution logs | Required | Scheduling local Worker nodes and collaboratively executing on-device RPA and script tasks |
| Task assets and orchestration configurations | Workflow orchestration, Automation scheduling configurations, trigger rules | Required | Workflow version management, automated scheduling, trial runs, monitoring and alerts |
| Authorization and credential information | Third-party system OAuth Access Tokens, API keys, connector configuration parameters | Optional (configured as needed) | Data interoperability with third-party systems such as enterprise IM, e-commerce backends and ERP |
| Operations diagnostics and audit data | Operation audit logs, Job instance duration, Credit deduction records, error and crash stacks | Required | Ensuring stable system operation, implementing compliance audit trails and technical troubleshooting |
I. Collection and Use of Personal Information
We follow the principles of “lawfulness, legitimacy, necessity and good faith” and collect and process your personal information only for the specific business feature purposes described in this Policy. If the processing of particular information goes beyond the original purpose, we will notify you again and obtain your consent in accordance with law.
Regarding sensitive personal information: The Service does not proactively collect your sensitive personal information in ordinary usage scenarios. We may process your sensitive personal information in scenarios such as real-name verification (for example, identity document numbers and document images), payment settlement (for example, bank account or payment account information) and certain third-party system authorizations. In such cases, in accordance with the Personal Information Protection Law, we will inform you of the necessity of processing such sensitive personal information and its impact on your personal rights and interests, and obtain your separate consent; you have the right to refuse, but this may prevent you from using features that depend on that information.
1. Account Registration, Login and Organization Management
| Item | Description |
|---|---|
| Types of information collected | Required information: Business email address or mobile phone number, login password (stored in encrypted form), dynamic SMS/email verification code, unique system user identifier (User ID), IP address. Optional information: User nickname, avatar, company name, third-party single sign-on authorization identifier (such as an OpenID/UnionID from 钉钉/飞书/企业微信). |
| Collection method | Actively entered and provided by the user, or synchronized from an authorized third-party enterprise SSO system. |
| Purpose of use | Identity authentication, account creation and management, establishment of membership relationships across multiple tenant organizations, and protection of account login security. |
| Legal basis | Necessary for entering into and performing a contract to which you are a party. |
2. Intelligent Conversation, Task Perception and Execution Services
| Item | Description |
|---|---|
| Types of information collected | Required information: Natural language instructions entered in the conversation box, uploaded attachments (documents, spreadsheets, images, etc.), and task prompts (Prompt); text answers, structured reports, execution code and task deliverables (Artifact) generated by the Agent; task execution instances (Job ID) and step traces (Event). Optional information: Client clipboard contents (temporarily stored and processed on the frontend only when you actively click Paste or authorize a paste operation). |
| Collection method | Actively entered or uploaded by the user in a conversation, or automatically recorded and generated by the system during execution. |
| Purpose of use | Understanding task intent, calling the inference engine to generate answers, driving toolchains to execute business actions, presenting continuity across historical conversations, and providing evidence for task reviews. |
| Legal basis | Necessary for entering into and performing a contract to which you are a party. |
3. On-Device Local Execution and Worker Services
| Item | Description |
|---|---|
| Types of information collected | Required information: Bound device identifier (Device UUID), operating system version, client runtime environment version, Worker online and busy status; local paths of task files expressly designated and authorized by you, execution result summaries, task execution exit codes and error logs. Optional information: Personalized local Worker settings and task directory allowlist configurations (stored on the user’s local device). |
| Collection method | The local Soia Worker client reads the information and returns status and task execution results to the cloud within the scope of authorization. |
| Purpose of use | Establishing a persistent scheduling connection between the cloud and on-device Workers, executing file parsing and RPA processes locally, and reporting task progress and execution status. |
| Legal basis | Necessary for entering into and performing a contract to which you are a party. |
4. Workflow Orchestration and Automation Operation
| Item | Description |
|---|---|
| Types of information collected | Required information: Workflow node definitions (LLM nodes, tool nodes, code nodes, logical branches), input/output parameter mappings and version snapshots; Automation configurations (Cron expressions, trigger source types, notification recipient channels, SLA rules); execution logs, Credit consumption metering data and failure breakpoint information. |
| Collection method | Actively configured by users in the workspace and automatically recorded by the system during scheduled execution. |
| Purpose of use | Supporting visual workflow building, trial runs, version rollback and cross-team reuse; executing automated monitoring tasks according to preset schedules and sending alerts when exceptions occur. |
| Legal basis | Necessary for entering into and performing a contract to which you are a party. |
5. Enterprise Knowledge Base and File Space Services
| Item | Description |
|---|---|
| Types of information collected | Required information: Source folder path identifiers, files uploaded to the Knowledge Base (PDF, DOCX, XLSX, PPTX, TXT, MD, HTML, etc.), structured text chunks extracted through parsing (Docling outputs), vector embedding feature data (Embedding), file summaries and knowledge retrieval matching records. |
| Collection method | Files are uploaded or file space directories associated by the user, and the system automatically processes and generates the data in the background. |
| Purpose of use | Building private retrieval-augmented indexes (RAG) for tenants or workspaces, providing professional background context to Agents, and adding precise provenance citations when generating answers. |
| Legal basis | Necessary for entering into and performing a contract to which you are a party. |
6. Third-Party System Integration and Connector Services
| Item | Description |
|---|---|
| Types of information collected | Required information: Access tokens for third-party services you link (OAuth Access/Refresh Token), Webhook destination addresses, OpenAPI access keys (AK/SK) and integrated application identifiers. Optional information: Business data excerpts retrieved from or exchanged with third-party systems during automated task execution. |
| Collection method | Authorization actively configured by the user in the system Console, or information received by the system through authorized API interfaces. |
| Purpose of use | Enabling two-way data interaction and delivery of automated instructions between Soiawork and external collaboration software (such as 钉钉, 飞书 and 企微) and business platforms. |
| Legal basis | Your separate authorization and consent. |
7. Operational Security, Runtime Quality and Diagnostic Audit Data
| Item | Description |
|---|---|
| Types of information collected | Required information: Login and access logs, security audit logs (including operation time, Principal identity, request URL, operation type, client IP address, network access protocol and operation status response code); crash diagnostic logs and system exception stacks. |
| Collection method | Automatically recorded by underlying system and gateway components. |
| Purpose of use | Ensuring network and system availability, preventing online fraud and hacker attacks, and satisfying the mandatory compliance requirement under the Cybersecurity Law to retain network operation logs for at least 6 months. |
| Legal basis | Fulfillment of statutory obligations and the legitimate interests of maintaining secure network operations. |
8. Statutory Exceptions to Consent Requirements
In accordance with laws and regulations, we do not need to separately obtain your authorization and consent to collect and use relevant information in the following circumstances:
Where necessary for entering into or performing a contract to which the individual is a party;
Where necessary for performing statutory duties or obligations (such as cybersecurity audits, anti-telecom and online fraud requirements, and anti-money laundering regulatory requirements);
Where necessary for responding to public health emergencies, or for protecting natural persons’ life, health and property in emergencies;
Where processing personal information voluntarily disclosed by individuals or otherwise lawfully made public within a reasonable scope in accordance with law;
Other circumstances provided by laws and administrative regulations.
II. Model Training and Data Use Policy
1. Strict Prohibition on Using User Data to Train Large Models
We make a legally binding commitment to all Soiawork users: Shizai Intelligence does not use any of your business data to train models.
Zero Data Flowback: Your input instructions (Prompt), conversation context, task parameters, uploaded enterprise documents, local file processing outputs, workflow orchestration and task execution records will never enter the pre-training corpora, fine-tuning corpora or instruction evaluation datasets of any foundation large model, open-source large model, industry-specific large model or algorithm independently developed by Shizai Intelligence;
Physical Architectural Isolation: The platform sets strict privacy parameters for all outbound model requests at the gateway scheduling layer and connects directly through secure channels to model nodes that have completed national generative artificial intelligence service filing. Computation is performed immediately in controlled memory, without retaining any training data;
Provider Agreement Safeguards: Shizai Intelligence has signed legally binding Data Protection and No-Training Agreements (DPA) with all upstream foundation large model providers supplying model inference services (such as 阿里云), expressly prohibiting upstream providers from using user Input/Output data transmitted through APIs for their own model training or commercial optimization.
III. Storage and Security Protection of Personal Information
1. Storage Location
Personal information and business data collected and generated by us within the People’s Republic of China are strictly stored within the People’s Republic of China (deployed in 阿里云 data centers certified at Level 3 of the national classified protection of information security scheme). No overseas transfer occurs without the statutory security assessment.
2. Retention Periods
We retain your personal information and data only for the shortest period necessary to achieve the purposes described in this Policy:
| Information Category | Retention Period | Handling upon Expiry |
|---|---|---|
| Core account information (email address, mobile phone number, etc.) | Retained throughout the life of the account; cleanup completed within 30 days after account closure | Physical deletion or de-identification and anonymization processing |
| Task Input and temporary intermediate artifacts | Cloud cache retained for a maximum of 14 days (for continuous conversation interaction); local Worker data managed by users themselves | Automatic cloud cleanup upon expiry |
| Knowledge Base documents and vector indexes | Retained for as long as the associated file space or Knowledge Base exists; deletion of the corresponding file by the user immediately triggers synchronized index destruction | Asynchronous disassociation and physical deletion of vector chunks |
| Workflow and Automation configurations | Retained throughout the business lifecycle; physical cleanup within 30 days after active deletion by the user | Physical removal of corresponding version data |
| Financial transactions, orders and top-up records | Retained for at least 5 years from completion of the transaction, as required by tax laws and accounting regulations | Compliant destruction after the statutory period expires |
| System security and audit logs | Strictly retained for at least 6 months pursuant to Article 21 of the Cybersecurity Law of the People’s Republic of China | Rolling overwrite or offline archiving and destruction |
3. Security Technology and Management Measures
Encryption in Transit and at Rest: TLS 1.3 / HTTPS high-strength network transport encryption protocols are mandatory across the site; core data (password hashes, OAuth keys and credential ciphertext) are stored at rest using AES-256 or encryption algorithms of an equivalent level;
Strong Multi-Tenant Logical Isolation: Databases and vector stores adopt tenant isolation mechanisms (physical/row-level binding validation by Tenant ID) to strictly prevent unauthorized access across tenants and organizations;
Controlled Access Permissions: We implement the principle of approval for minimum necessary permissions (RBAC/ReBAC). Production database operations require two-person, multi-factor authorization, and operations access is recorded by screen capture throughout the entire process for audit trails;
Security Emergency Response: We have established a 72-hour security incident emergency response plan. If a personal information security incident occurs, we will activate the emergency plan in accordance with law to bring the situation under control and, within 72 hours after confirming the incident, inform affected users by email, telephone, in-service message or system announcement of the basic circumstances, scope involved, remedial measures taken and recommended self-protection measures, and truthfully report the incident to cyberspace, public security and other regulators as required by law.
IV. Sharing, Transfer and Public Disclosure of Personal Information
1. Sharing Principles and List of Recipients
We will not sell your personal information to any third party. We share only the information necessary to provide services with third-party partners possessing the required compliance qualifications, and only for lawful, legitimate, necessary, specific and explicit purposes:
| Recipient Type | Typical Institutions / Providers | Scope of Shared Data | Purpose of Shared Processing | Security Controls |
|---|---|---|---|---|
| Large model inference service providers | 阿里云 (通义千问) and other model service providers that have completed national filing | Task instruction text, prompts, necessary context | Providing large language model inference and natural language understanding services | Signing DPA data protection agreements stipulating zero-retention and no-training terms |
| Cloud infrastructure providers | 阿里云计算有限公司 | Database ciphertext, encrypted file objects | Providing highly available cloud server hosting, object storage and underlying network computing infrastructure | Passing Level 3 classified protection assessment, with physical network isolation and full-disk encryption |
| Third-party integration service providers | 钉钉, 飞书, 企业微信 and other third-party collaboration platforms | Task notification content, execution summaries, approval status data | Sending task result notifications to designated external IM groups or individuals according to user instructions | Binding through explicit user authorization and controlled authentication using OAuth authorization tokens |
| Communications and SMS service providers | Licensed telecommunications operators and SMS channel providers authorized by the Ministry of Industry and Information Technology | Mobile phone numbers, verification code template content | Sending login verification codes, password reset credentials and important system security reminders | Signing strict non-disclosure agreements and prohibiting use for any marketing or commercial purposes |
Separate consent and list updates: Where your personal information is provided to a third party, we will inform you of the recipient’s name, contact details, processing purposes, processing methods and types of personal information, and obtain your separate consent in accordance with law (unless otherwise provided by laws and regulations). The recipient list above will be updated as business changes; the latest version is available on the compliance page of the official website. If a new type of recipient is added or the scope of sharing is expanded, we will fulfill the notification and renewed consent procedures specified in Article VII of this Policy.
2. Transfer
Shizai Intelligence will not transfer control over your personal information to any company, organization or individual, except in the following circumstances:
Your explicit separate consent has been obtained in advance;
Where a transaction such as a merger, acquisition, division, bankruptcy liquidation or major asset restructuring involves the transfer of personal information, we will inform you of the recipient’s name and contact details and require the company newly holding your personal information to continue to be bound by this Privacy Policy; if the purposes or methods of personal information processing change, that company will obtain your authorization and consent again.
3. Public Disclosure
Unless otherwise provided by laws, regulations, judicial decisions or compulsory enforcement orders of administrative authorities, Shizai Intelligence will never voluntarily disclose your personal information to the public.
V. Your Rights as a Personal Information Subject
Under the Personal Information Protection Law of the People’s Republic of China, you enjoy full statutory rights in personal information processing activities. You may exercise these rights yourself by following the guidance in this section or contact us for assistance:
1. Rights to Access, Copy and Transfer
You have the right to log in to the Soiawork Console and enter “Personal Center” or “Tenant Settings” to view your account details, login devices, bound Workers, workflows and task records. If you need a copy of your personal information or request that data be transferred to a designated processor, you may submit a written application to the compliance email address. After verifying your identity and confirming technical feasibility, we will cooperate in providing it in accordance with law.
2. Rights to Correction and Supplementation
If you discover errors or omissions in your personal information that we process, you may modify it directly on the relevant system page, or contact our customer service and technical support teams to request correction or supplementation.
3. Right to Deletion
In the following circumstances, you have the right to delete your personal information through the Console or ask us to delete it:
The processing purpose has been achieved, cannot be achieved, or the information is no longer necessary to achieve that purpose;
We stop providing Soiawork products or services, or the retention period has expired;
You have withdrawn your consent to processing;
We process your personal information in violation of laws, administrative regulations or our agreement.
4. Right to Account Closure
You have the right to submit an account closure application on the “Account Security” page in the Console or send a closure request to the compliance email address. After receiving the application and verifying your identity and tenant settlement status, we will complete closure approval and data cleanup within 15 to 30 working days (data cannot be recovered after closure takes effect, except for information that must be retained as otherwise required by laws and regulations).
5. Right to Withdraw Consent
You have the right to unlink third-party platform connectors, disable local Worker authorization or withdraw authorization at any time. After you withdraw consent, we will no longer process the corresponding personal information; however, this does not affect the lawfulness and validity of personal information processing activities already conducted on the basis of your authorization before withdrawal.
6. Right to Restrict Automated Decision-Making
Soiawork’s task orchestration, workflow recommendations and exception predictions may operate through algorithms and automated decision-making mechanisms. You have the following explicit right: in production environments, all workflow changes, high-risk system operations or approval proposals autonomously recommended by AI agents must be explicitly confirmed or adopted by users through a human-operated interface before taking formal effect; you have the right to request human intervention to verify automated execution results at any time.
VI. Protection of Minors
1. Age Eligibility Restriction
Soiawork is an enterprise collaboration and productivity tool platform for adults and is provided only to adults aged 18 or above who have full capacity for civil conduct. We do not provide any products or services to minors under 18.
2. Procedure for Handling Minors’ Information
We do not knowingly collect personal information from, or induce its provision by, minors under 18;
This product does not provide a “Teen Mode” for minors;
If a guardian, user or we discover that a minor has registered for or used the Service without their guardian’s knowledge and consent, we will, immediately after verification, take strict measures to freeze the account, terminate services and completely destroy the relevant data involved within 48 hours; if a guardian objects or wishes to assert rights, please immediately contact us using the contact details at the end of this document.
VII. Updates and Revisions to the Privacy Policy
1. Revision Mechanism and Notification
To provide better services and strictly respond to national laws and regulations, Shizai Intelligence reserves the right to revise this Privacy Policy from time to time. After revision, we will publish the latest version on the official website and indicate the “Publication Date” and “Effective Date” at the top of the page.
2. Renewed Confirmation of Material Changes
When substantive material changes occur to this Policy (including, but not limited to, material changes to the purposes and types of personal information processing, substantive adjustments to external sharing or public disclosure rules, material changes to the methods for exercising user rights, or changes to our department responsible for personal information security or its contact details), we will specifically notify you through prominent means such as conspicuous system login pop-ups, in-service messages, push notifications or email, and implement the changes only after obtaining your explicit consent again. If you continue to use the Service after the update takes effect, you indicate that you have fully understood and agree to be bound by the revised Privacy Policy.
3. Access to Historical Versions
We will archive and retain historical versions of this Policy from the most recent twenty-four (24) months on the official website, allowing you to review the evolution of the Policy at any time.
VIII. Governing Law and Jurisdiction
The formulation, validity, interpretation, performance and dispute resolution of this Privacy Policy shall be governed strictly by the laws of mainland People’s Republic of China. Any dispute arising from or relating to this Policy shall be resolved by the parties through amicable, good-faith negotiation; if negotiation fails, either party has the right to bring proceedings before the competent People’s Court at the domicile of Zhejiang Shizai Intelligent Technology Co., Ltd. (namely, the People’s Court of Yuhang District, Hangzhou, Zhejiang Province).
IX. Contact Us
If you have any questions, complaints, comments or suggestions concerning this Privacy Policy or personal information protection, or wish to exercise your statutory personal information rights, please contact us through the following dedicated compliance channels:
Company: Zhejiang Shizai Intelligent Technology Co., Ltd.
Legal Registered Address: Room 106, 1st Floor, Building 10, No. 1397 Qingyuan Road, Lingfeng Subdistrict, Anji County, Huzhou, Zhejiang Province
R&D and Operations Headquarters: 3rd Floor, Building 4, Nanhu Future Science Park, No. 2 Tongshanxi Road, Yuhang District, Hangzhou, Zhejiang Province
Customer Service and Technical Support Email: support@soiawork.cn
Official Website: https://soiawork.cn
We will complete verification and provide you with a formal written response within fifteen (15) working days after receiving your request and correctly verifying your user identity.