Privacy Policy

1. Who is responsible for your information?

The website is operated by Shanghai APIS Consulting Ltd. Co. (上海安匹思信息技术有限公司), trading as APIS Consulting, in Shanghai, China. APIS Consulting is responsible for the personal information described in this policy.

Privacy questions and requests can be sent to contact@apisconsulting.cn.

2. What information do we collect?

We collect only the information needed to provide the feature you choose to use:

• Contact form: your name, company, email address and message.
• Free audit: your name, company, email address, answers and assessment result.
• Security and delivery data: submission time and limited technical information, such as an IP address, where needed to prevent abuse, investigate delivery problems or protect the website.
• Server logs: our hosting provider may record standard request information, such as IP address, browser type, requested page and timestamp.
• Anonymous site statistics: daily aggregate counts of page views, entry pages, language, same-site page-to-page transitions, completed audits, completed awareness exercises by game and successful contact submissions. These counters contain no IP address, user agent, full referrer URL, user ID, exercise answers, password examples or individual browsing history.

The website does not create user accounts and does not use analytics cookies, third-party analytics scripts, advertising cookies or tracking pixels. The Password Strength Duel evaluates entries inside your browser; the password entered is not submitted to or stored by APIS Consulting.

3. Why do we use this information?

• To respond to enquiries and take steps requested before a possible engagement.
• To calculate and email a free-audit result.
• To operate, secure and troubleshoot the website and its email delivery.
• To understand which content is useful and improve navigation using anonymous aggregate statistics.
• To prevent spam, fraud and misuse, and to comply with applicable legal obligations.

Depending on the circumstances and applicable law, processing is based on your request or consent, steps taken before entering into a contract, our legitimate interest in operating a secure business website, or a legal obligation. You may withdraw consent at any time where consent is the applicable basis; this does not affect earlier lawful processing.

4. Who receives the information?

Access is limited to authorised APIS Consulting personnel and service providers that support website hosting, email delivery, security and maintenance. We do not sell personal information and do not share it for third-party advertising.

A provider may process information in a country or region different from yours. Where a cross-border transfer is subject to legal requirements, we take the steps required by applicable law and use appropriate contractual, organisational or technical safeguards.

5. How long do we keep it?

We keep enquiries and assessment correspondence only for as long as reasonably needed to reply, manage a possible business relationship, maintain appropriate business records, resolve disputes and meet legal obligations. Retention therefore depends on the nature of the exchange.

The website rate limiter stores a one-way identifier derived from the IP address, rather than the raw IP address, together with submission timestamps. Entries older than the active rate-limit window are removed during the next cleanup. Hosting and email providers apply their own documented retention periods to technical logs and messages.

Anonymous site statistics are retained for up to 400 days. The application stores only combined daily counters, so there is no visitor profile or individual browsing record to retain.

6. How do we protect it?

We use proportionate technical and organisational measures, including encrypted connections, access controls, input validation, form-abuse controls and restricted administrative files. No internet transmission or storage system can be guaranteed completely secure.

7. Your choices and rights

Subject to the law applicable to you, you may ask whether we process your personal information and request access, correction, deletion, restriction, objection, withdrawal of consent or a portable copy. You may also have the right to complain to a competent data-protection authority.

Send a request to contact@apisconsulting.cn. We may ask for enough information to verify your identity and locate the relevant records before acting on a request.

8. External links

This website links to third-party services such as LinkedIn and WeChat. Their privacy practices apply once you leave this website; APIS Consulting does not control those services.

9. Changes to this policy

We may update this policy when the website, our practices or applicable requirements change. The date above identifies the current version.