Privacy Policy
Updated Date: 8/25/2026
This Privacy Policy applies to the Evaluation Cat Enterprise Information Security Assessment Platform (hereinafter "EvaluationCat", "we" or "us"). We understand the importance of personal information to you. We will collect, use, process, and store your personal information strictly in accordance with relevant laws and regulations and the terms of this Privacy Policy.
This Privacy Policy aims to help you understand the following:
- Who is the data controller and how to contact us
- How we collect and use your personal information
- How we use Cookies or similar technologies
- How we entrust processing, share, transfer, and publicly disclose your information
- How we protect your personal information
- How long we store your personal information
- Your rights and how to exercise them
- How we protect minors' personal information
- How we handle cross-border transfer of personal information
- How to get updates to this privacy policy
Before using our products or services, please be sure to read and fully understand this Privacy Policy. Once you start using our products or services, or submit personal information to us, it means that you are aware of all the terms of this Privacy Policy and fully agree to our processing of this information in accordance with this Privacy Policy.
1. Data Controller
The data controller of this Service is:
- Operator: EvaluationCat (operator of https://evaluationcat.com)
- Registered address: Unit 2603, Building 12, Keyu New Village, Guangming District, Shenzhen, China
- Privacy contact email: support@evaluationcat.com
- Data Protection Officer (DPO): Not currently appointed — privacy requests are handled by the support team
If you have any questions, comments, or suggestions regarding the content of this Privacy Policy, you can contact us through any of the contact methods displayed in Section 14 of this Privacy Policy.
2. How we collect and use your personal information
Personal information refers to various information recorded electronically or in other ways that can identify the identity of a specific natural person alone or in combination with other information, or reflect the activities of a specific natural person. In the process of using our products or services, we will only collect your personal information when it is absolutely necessary and within a very limited scope, and this information is only used to provide you with products or services, optimize our products or services, and ensure the security of your account.
2.1 Information You Actively Provide
- Registration and account management: name, email address, company name, contact phone number, and password (stored encrypted), used to determine your user identity and for customer service to contact you when necessary. We recommend providing a business email rather than a personal email.
- Enterprise assessment service: company name, industry classification, company size, and contact person information you fill in, used to generate assessment reports and provide customized services.
- Supply chain assessment invitations: if you use the supply chain assessment function, the vendor's contact email you provide is used to send assessment invitations to your vendors. Please ensure you have obtained the vendor's explicit authorization before sending the invitation.
- Payment information: transaction amount and payment status. We do not store complete card numbers — payment card data is processed exclusively by our PCI-DSS compliant payment processors (see Section 5).
- Communication records: emails, support tickets, and feedback you send to us.
2.2 Information We Collect Automatically
- Device and network: IP address, device model, operating system, browser type, and time zone.
- Usage behavior: page visits, feature usage, operation logs, and session duration.
- Log data: request time, error logs, and performance data.
- Service optimization: search terms, keywords, and assessment data you enter, used to improve your service experience.
2.3 Scope Changes and Third-party Information
If we need to collect and use your personal information beyond the aforementioned scope due to service adjustments or function updates, we will inform you again and obtain your authorization again. Currently, we do not actively obtain your personal information from third parties. If we need to collect such personal information in the future, we will obtain your explicit consent first, and require the third party to ensure the legality of the information provided.
3. Purposes and legal basis of processing
| Purpose | Legal Basis |
|---|---|
| Providing and maintaining the assessment service | Contract performance |
| Billing and payment processing | Contract performance |
| Customer support | Contract performance / legitimate interests |
| Service notifications (billing, security, policy updates) | Legitimate interests |
| Security and fraud prevention | Legitimate interests |
| Product optimization and analysis | Legitimate interests |
| Legal compliance | Legal obligation |
We may aggregate or de-identify data for statistical analysis. Such data cannot be linked to a specific individual.
4. How we use Cookies or similar technologies
To ensure the normal operation of the website, we store small data files called Cookies on your computer or mobile device. Cookies usually contain identifiers, site names, and some numbers and characters.
| Type | Purpose | Can Be Disabled |
|---|---|---|
| Strictly necessary | Maintaining login status and core functions | No |
| Functional | Language and preference settings | Yes |
| Analytics | Anonymous usage statistics and service optimization | Yes |
We use Cookie data files to determine the identity and login status of registered users, improve service quality, and optimize user experience. We will not use Cookies for any purpose other than those described in this Privacy Policy. You can manage or delete Cookies according to your preferences. If you do not want the aforementioned information to be retained in Cookies, you can block or clear Cookies through your browser settings.
5. How we entrust processing, share, transfer, and publicly disclose your information
We do not sell your personal information, including "sale" as defined under applicable laws such as CCPA. We share your information only in the following circumstances:
- Service providers: cloud computing, payment, customer service, and email delivery vendors, bound by confidentiality and data protection agreements. Payment card data is processed exclusively by our PCI-DSS compliant payment processors (including Waffo Pancake, Creem, Alipay, and WeChat Pay, depending on the payment method chosen) and is not stored on our servers.
- New functions and entrusted processing: if we need to introduce third-party vendors for developing new functions and modules, we will strictly review their qualifications, sign data protection agreements and confidentiality agreements, and inform you and obtain your authorization before entrusting them to process your personal information.
- Legal and regulatory requirements: disclosure as required by applicable laws, court orders, or competent authorities' lawful requests.
- Business transactions: in the event of a merger, acquisition, or bankruptcy liquidation involving personal information transfer, we will require the new company or organization holding your personal information to continue to be bound by this Privacy Policy.
- With your consent: with your explicit prior authorization, we will transfer your personal information to other parties.
6. How we protect your personal information
6.1 Security Technology Measures
We attach great importance to personal information security and take security technology measures that comply with industry standards to protect the personal information you provide, including data encryption (TLS/HTTPS in transit, encrypted storage of passwords and sensitive data), access control, and security audits.
6.2 Management System Guarantee
We guarantee information security by establishing specialized management systems, processes, and organizations. We only allow staff who need to contact customer information to access the system backend, strictly set access levels, and require all personnel who may come into contact with your personal information to fulfill corresponding confidentiality obligations, following the principle of least privilege.
6.3 Security Incident Handling
If a personal information leakage or other security incident occurs, we will launch an emergency plan to prevent the security incident from expanding, and notify you and relevant regulatory authorities through push notifications, announcements, etc. within 72 hours of discovery, in accordance with the law.
6.4 Your Security Responsibility
Ensuring the security of your personal information requires the joint cooperation of you and us. Please do not disclose your login account and password to others. If you discover that your personal information, especially your account or password, has been leaked, please contact us immediately so that we can take corresponding reasonable measures according to your application.
7. How we store your personal information and retention periods
We only retain your personal information for the time necessary to achieve the purposes described in this Privacy Policy, unless the law requires or allows this information to be retained for a longer period. Personal information collected and generated within the People's Republic of China will be stored within the People's Republic of China.
| Data Type | Retention Period | Handling at Expiry |
|---|---|---|
| Account information | During the validity period; up to 90 days after account deletion | Deleted or anonymized |
| Assessment data and reports | During the validity period; up to 90 days after account deletion | Deleted or anonymized |
| Transaction records | As required by tax and accounting regulations (typically 5 years or longer) | Deleted or archived |
| Customer service records | 2 years | Securely deleted |
| Security and operation logs | 6 months | Securely deleted |
If your account expires or you actively delete the above information, we will anonymize your personal information in accordance with laws and regulations, and will no longer use it for commercial purposes. If an operation termination occurs, we will notify you at least one month in advance, and delete or anonymize your personal information after the operation termination. If the retention period stipulated by laws and administrative regulations has not expired, or it is technically difficult to delete personal information, we will stop processing other than storage and taking necessary security protection measures.
8. How we guarantee your rights
In accordance with relevant laws and regulations, we will guarantee your exercise of the following rights regarding your personal information. To exercise any of these rights, contact us at support@evaluationcat.com. We will respond within 15 working days from the date of receiving your request, or within the time limit required by laws and regulations. If you believe we have not handled your request properly, you have the right to complain to the competent data protection authority.
8.1 Access and correct your personal information
Unless otherwise provided by laws and regulations, you have the right to access your personal information; at the same time, if you find that there are errors in your personal information we are processing, you have the right to ask us to correct it.
8.2 Delete your personal information
In the following circumstances, you can request us to delete personal information: if we collect, use, share, or disclose your personal information in violation of laws and regulations; if we violate the agreement with you; if you no longer use our products or services; if we stop operating.
8.3 Withdraw consent
You can withdraw your authorization for us to collect personal information or change the scope of your authorization by closing the corresponding function service or contacting us. The realization of some business functions relies on basic personal information. If you choose to withdraw your consent or authorization, we will not be able to continue to provide you with the corresponding service.
8.4 Cancel account
You can request to cancel your account via customer service email, and we will complete your request within 15 working days or within the time limit required by laws and regulations. After you complete the account cancellation, we will stop providing you with corresponding products and services, and delete relevant personal information or anonymize the information.
8.5 Obtain a copy of personal information (data portability)
You have the right to obtain a copy of your personal information in a machine-readable format. Under the premise of technical feasibility, we will transfer a copy of your personal information directly to the third party you designate according to your request.
8.6 Object to processing and restrict processing
You have the right to object to the processing of your personal information based on legitimate interests or for marketing purposes, and to request restriction of processing in specific circumstances.
9. Marketing communications and opt-out
With your consent, we may send you marketing information about product updates and feature recommendations via email or in-product notifications. You can unsubscribe at any time by clicking the "unsubscribe" link in emails, turning off notifications in your account settings, or contacting us. Unsubscribing does not affect service-necessary notifications (such as billing, security alerts, and report delivery notifications).
10. How we handle cross-border transfer of personal information
Personal information collected and generated by this website in China will only be stored in China. If some products or services involve cross-border transfer, or our servers or service providers are located overseas, we will strictly implement it in accordance with laws and regulations, adopt necessary safeguards (such as standard contractual clauses or certifications required by applicable law), and ensure the security of your personal information.
11. How we protect minors' personal information
This Service is an enterprise-oriented service, is not targeted at minors, and has a minimum age of 18. We will not knowingly collect personal information from anyone under 18. If we need to collect minors' information under special circumstances, we will obtain the explicit authorization and consent of parents or guardians in advance and issue a separate privacy policy.
If you find that minors' information has been collected and used without authorization, please contact us to delete it, and ensure that the minor cancels our service. We will delete such information as soon as possible.
12. Third-party links and services
This Service may contain links to third-party websites or integrate third-party services (such as payment processors). This Privacy Policy applies only to information we collect directly. We are not responsible for the data practices of third parties. We recommend that you review their privacy policies before using them.
13. How to get updates to this privacy policy
Due to changes in service content, contact information, laws and regulatory policy requirements, etc., we may revise this Privacy Policy from time to time. For material changes, we will provide at least 15 days advance notice via platform announcements or the email address you provide, and update the "Updated Date" at the top of this page. In order for you to receive notifications in time, it is recommended that you update your account information or notify us in time when your email address changes. Continued use of the Service after the effective date constitutes acceptance of the revised policy.
14. How to contact us
In all cases mentioned in this Privacy Policy where you may need to contact us, you can contact us in the following ways:
Email: support@evaluationcat.com
Website: https://evaluationcat.com
Updated Date: 8/25/2026