tutucash Privacy Policy

Last Updated: 2026-07-28
Effective Date: 2026-07-28
Version: v1.0

This document is the Privacy Policy for the tutucash application, suitable for App Store / TestFlight / Enterprise distribution submission.

1. Introduction

tutucash (the "App") is developed and operated by Guangzhou Tianxingke Network Technology Co., Ltd (referred to as "we" or "the Company"). It is a multi-role internal bookkeeping tool for use exclusively by authorized employees of the Company.

We take your privacy very seriously. This Privacy Policy is drafted in accordance with three jurisdictions:

Personal Information Protection Law of the People's Republic of China (PIPL)
Act on the Protection of Personal Information of Japan (APPI)
Various Personal Data Protection Acts across Southeast Asia (see Section 15.5)

By using this App, you acknowledge and agree to this Privacy Policy.

1.5 Scope Extension

This Privacy Policy applies to all employees of tutucash worldwide, regardless of their location:

Employee residence / work location may be in Mainland China / Japan / Korea / Singapore / Thailand / Vietnam / Malaysia / Taiwan / Hong Kong / Macau / other
Employees on short business trips or working remotely also fall under this policy when using the App
Data processing during overseas business travel is also subject to this policy

As employees are distributed across multiple countries, this policy is designed to simultaneously comply with the following data protection laws (see Section 15 for details):

Mainland China PIPL
Japan APPI
Korea PIPA
Singapore PDPA
Thailand PDPA
Vietnam Decree No. 13/2023/ND-CP
Malaysia PDPA 2010
Taiwan Personal Data Protection Act
Hong Kong PDPO

2. Information We Collect

2.1 Actively Provided (entered by the Company backend)

Data	Purpose	Retention
Employee account info (name, employee ID, role)	Identity verification and login	Account deleted 30 days after departure
Role (employee / leader / admin)	Permission control	Deleted on departure
Bookkeeping records (amount, category, time, notes)	Core business	Long-term retention (Company archives)
Photo receipts (invoices, bills, screenshots)	Business attachment archive	Long-term retention (bound to records)
Company org structure (departments, reporting lines)	Leader review and statistics	Long-term retention

2.2 Automatically Collected

Data	Purpose	Retention
Device model / OS version	Troubleshooting	3 months
Crash logs (anonymized)	Bug localization	3 months
Access logs (who, when, viewed what)	Internal audit	Long-term retention

2.3 We Do NOT Collect

❌ Location data (GPS)
❌ Contacts / Communication history
❌ Any biometric data (face / fingerprint)
❌ Any marketing / advertising tracking data
❌ Any data used for machine learning training

3. Purpose of Use

Purpose	Description
Business functionality	Daily bookkeeping, leader review and approval
Internal management	Role permissions, account lifecycle
Audit compliance	Financial reconciliation, regulatory inspection
Troubleshooting	Crash analysis, performance optimization
Security protection	Abnormal login detection

NEVER used for: marketing / user profiling / personalized recommendations / resale / AI training.

4. Multi-Role Permissions

Role	Permission Scope
Employee	Only their own bookkeeping data
Leader	All employees' bookkeeping data / approval / export
Admin	User management / system configuration / delete operations

Leader access to all employee data is a necessary design, with hierarchical authorization within the Company.

5. Information Sharing

We DO NOT share your information with third parties, EXCEPT in the following circumstances:

Legal requirements (police / court / tax / financial regulatory investigations with proper authority)
Your explicit written authorization
Company merger / acquisition / asset transfer (with prior notice)
Life-safety emergencies

6. Data Storage & Security

Server Location: Japan
Storage Location: Tokyo, Japan data center
Transport Encryption: HTTPS / TLS 1.3
Storage Encryption: AES-256
Access Control: Role-based access control (RBAC) + multi-factor authentication
Audit Logs: All access and modification actions logged, long-term retention
Backup Strategy: Daily off-site automated backups, retained ≥ 90 days
Data Lifecycle:
- Employee active: data recorded normally
- Employee departed: account deleted, bookkeeping records retained for leader review (per internal financial policy)
- Company dissolved or service terminated: handled per Company resolution

7. Cross-Border Data Transfer ⚠️ Critical Section

7.1 Transfer Scenarios

Data from China (user device) → Japan (server): daily bookkeeping
Data from Japan → China (leader device): reverse review

7.2 Legal Basis

PIPL Articles 38-40: cross-border transfer requires CAC security assessment or Standard Contract
GDPR Article 46: third-country transfer requires adequacy decision or Standard Contractual Clauses (SCC)
Japan APPI Article 28: cross-border provision requires the data subject's consent

7.3 Our Commitments

✅ All transfers encrypted end-to-end (TLS 1.3 + AES-256)
✅ No sharing with third parties outside the Company
✅ Employees provide written consent for cross-border transfer at onboarding
✅ Transfer logs retained for audit

7.4 Risk Disclosure

Data is stored on servers in Japan and is subject to Japan's Personal Information Protection Act (APPI). In the event of a conflict between Chinese and Japanese law, Chinese law prevails.

7.5 Cross-Border Transfer (Multi-Country Version)

⚠️ Important: This section is an extension of Section 7, covering the multi-country employee + Southeast Asia scenarios.

7.5.1 Applicable Employee Distribution

Since employees may be distributed across multiple countries (specific distribution known by Company HR), this policy uniformly applies to cross-border transfers in the following scenarios:

Origin	Destination	Applicable Laws	Compliance Measures
Mainland China → Japan	Data storage	PIPL + APPI	PIPL Art. 38 SCC
Japan → Mainland China	Leader review	APPI → PIPL	Equivalent protection
Korea → Japan	Data storage	PIPA → APPI	Written consent + encryption
Singapore → Japan	Data storage	PDPA § 26 (Transfer Limitation)	Equivalent protection determination
Thailand → Japan	Data storage	PDPA § 24-25 (Cross-border Transfer)	Written consent + security measures
Vietnam → Japan	Data storage	Decree 13/2023 Art. 22-23	Written consent + cross-border impact assessment
Malaysia → Japan	Data storage	PDPA 2010 § 129	PDP Commissioner approval
Southeast Asia → Japan	Data storage	Respective PDPA	Written consent + encryption

7.5.2 Cross-Border Transfer Specific Measures

✅ Transport encryption: TLS 1.3 + AES-256
✅ No third-party sharing: for internal Company use only
✅ Written authorization: all employees sign cross-border transfer consent at onboarding
✅ Transfer logs: retained ≥ 1 year for audit
✅ Exit terms: data transfer after employee departure still follows Company policy

7.5.3 Country-Specific Requirements

Country	Cross-Border Requirements
🇨🇳 China	PIPL Articles 38-40 / CAC Assessment / SCC
🇯🇵 Japan	APPI Article 28 / Employee Written Consent
🇰🇷 Korea	PIPA / Cross-Border Impact Assessment
🇸🇬 Singapore	PDPA § 26 (Transfer Limitation) / Equivalent Protection Determination
🇹🇭 Thailand	PDPA B.E. 2562 § 24-25 / Written Consent
🇻🇳 Vietnam	Decree 13/2023 Art. 22-23 / Cross-Border Impact Assessment
🇲🇾 Malaysia	PDPA 2010 § 129 / PDP Commissioner Approval

8. Photo Receipts & Photo Library Access

8.1 What We Collect

You can actively upload photos as bookkeeping receipts (invoices, receipts, bill screenshots). Photos are bound to corresponding records for storage.

8.2 iOS Photo Library Permission Request

Starting from iOS 14, tutucash will show a system authorization dialog (PhotoKit framework) when you need to upload photos.

Our commitments:

✅ Only request permission when you click the "Upload Receipt" button
✅ Only access photos you actively select
❌ Do not upload unselected photos
❌ Do not read photo metadata (capture time / GPS / device, etc.)

8.3 Metadata Contained in Photos

Capture time
Capture device
[If GPS enabled: capture location]

Our commitments:

❌ Do not extract EXIF metadata
❌ Do not use for location tracking / behavioral analysis
✅ Only display and archive as receipt image content

8.4 Photo Storage and Deletion

Storage location: same as records (Japan)
Encryption: AES-256
Deletion rule: when a record is deleted, associated photos are deleted simultaneously

9. Third-Party Services

NO third-party SDKs (except Apple official services).

We do not integrate: advertising SDKs / marketing SDKs / user profiling SDKs / third-party analytics / any other third-party services.

9.5 Southeast Asia PDPA Summary (Multi-Country Adaptation)

Since employees may be distributed across multiple Southeast Asian countries, this section provides a unified explanation of each region's data protection law requirements for tutucash.

9.5.1 Singapore PDPA (Personal Data Protection Act 2012)

Key Obligations:

Consent: collection, use, and disclosure of personal information requires explicit consent
Purpose Limitation: only for declared purposes
Notification: inform employees of collection purpose
Transfer Limitation: PDPA § 26 — cross-border transfer requires equivalent protection
DPNPC (Do Not Call): only applies to marketing, not internal use

Our Commitments:

✅ Obtain written consent at employee onboarding (satisfies Consent principle)
✅ Clearly inform collection purpose (satisfies Notification principle)
✅ Data only used for bookkeeping and internal management (satisfies Purpose Limitation)
✅ Cross-border transfer to Japan meets equivalent protection determination

9.5.2 Thailand PDPA (Personal Data Protection Act B.E. 2562 / 2019)

Key Obligations:

Express Consent: PDPA § 19-20
Cross-Border Transfer: PDPA § 24-25
Data Protection Officer (DPO): controller or processor must appoint
PDPC (Personal Data Protection Committee): supervisory authority

Our Commitments:

✅ Written consent for cross-border transfer by Thai employees
✅ Cross-border transfer meets "adequate protection" or "explicit consent"
✅ DPO information in Section 16

9.5.3 Vietnam Personal Data Protection (Decree No. 13/2023/ND-CP, effective July 2023)

Key Obligations:

Data subject rights: right to know, consent, access, rectify, erase
Cross-Border Impact Assessment: Art. 22-23
Consent: must be explicit and specific

Our Commitments:

✅ Vietnamese employees provide written consent + cross-border impact assessment at onboarding
✅ Data subject rights see Section 10

9.5.4 Malaysia PDPA 2010 (Personal Data Protection Act 2010)

Key Obligations:

PDP Commissioner approval: cross-border transfer requires PDP Commissioner approval (§ 129)
Data Protection Officer (DPO): mandatory

Our Commitments:

✅ DPO information in Section 16
✅ Cross-border transfer complies with PDP Commissioner requirements

9.5.5 Common Compliance Requirements

Common Requirement	Description
Written Consent	All employees sign at onboarding
Explicit Purpose	Only for internal bookkeeping and review
Data Security	AES-256 + TLS 1.3 + RBAC
Cross-Border Transfer	Written consent + encryption + equivalent protection
Data Subject Rights	See Section 10
Complaint Channels	See Section 16.5

10. Your Rights

You may exercise the following rights at any time:

Right	Description	Response Time
Right of Access	Obtain a copy of all your data	15 business days
Right of Rectification	Modify incorrect data	Immediately
Right of Erasure (Right to be Forgotten)	Special Note: After employee departure, bookkeeping records are retained for leader review (per internal financial policy)	30 business days (account itself)
Right of Data Portability	Export in standard format (CSV / JSON)	15 business days
Right of Restriction	Temporarily freeze data processing	Immediately
Right to Withdraw Consent	Withdraw cross-border transfer consent	Immediately
Right to Lodge a Complaint	Complain to regulatory authorities	Permanent

Contact the Data Protection Officer (DPO): txk18122252653@163.com to exercise your rights.

10.1 Special Note on "Right to be Forgotten"

⚠️ Employee account deletion ≠ Data deletion. Per internal financial policies and legal requirements, employee bookkeeping records are retained for leader review (minimum 1 years). This is a lawful exception under GDPR Article 17(3)(b) "for compliance with a legal obligation."

11. Children's Privacy

tutucash is NOT intended for children under 18. If we discover a child has used the App, we will immediately delete their account.

12. Automated Decision-Making & Profiling

tutucash DOES NOT engage in any automated decision-making or user profiling. All data is reviewed manually, with no algorithmic scoring.

13. Data Security Incidents

In the event of a data breach, we will notify within 72 hours:

Affected employees
Regulatory authorities (China CAC / Japan PPC / Southeast Asia local PDPA authorities)
Data subjects when necessary

14. Changes to This Policy

When this policy changes:

Notify in-app
Note in App Store update description
Material changes will re-seek employee consent
Previous versions retained for reference

15. Governing Law & Disputes

Primary Governing Law: Laws of the People's Republic of China (Personal Information Protection Law)
Secondary Governing Law: Japan's APPI (since server is in Japan)
EU Users: GDPR additionally applies
Jurisdiction: People's Court of Guangzhou
Dispute Resolution: negotiation → arbitration → litigation
Cross-Border Disputes: Singapore Convention on International Arbitration

15.5 Southeast Asia Specific Laws

Country/Region	Law	Effective	Key Clauses
🇨🇳 Mainland China	PIPL Personal Information Protection Law	2021-11-01	Cross-border transfer requires CAC assessment / SCC
🇭🇰 Hong Kong	PDPO Personal Data (Privacy) Ordinance	1996 (revised 2013)	No cross-border transfer restrictions
🇲🇴 Macau	Personal Data Protection Law	2023-01-01	GDPR-equivalent level
🇹🇼 Taiwan	Personal Data Protection Act	2012-10-01	Cross-border transfer requires data subject consent
🇯🇵 Japan	APPI Personal Information Protection Act	2005 (revised 2022)	Cross-border transfer requires data subject consent
🇰🇷 Korea	PIPA Personal Information Protection Act	2011 (revised 2023)	Cross-border impact assessment
🇸🇬 Singapore	PDPA Personal Data Protection Act	2014-07-02	§ 26 Transfer Limitation
🇲🇾 Malaysia	PDPA 2010	2013-11-15	§ 129 Cross-border requires PDP Commissioner approval
🇹🇭 Thailand	PDPA B.E. 2562 (2019)	2022-06-01 (partial)	§ 24-25 Cross-border requires explicit consent
🇻🇳 Vietnam	Decree 13/2023/ND-CP	2023-07-01	Art. 22-23 Cross-border impact assessment
🇵🇭 Philippines	Data Privacy Act 2012	2012-09-08	NPC supervision, cross-border requires notification
🇮🇩 Indonesia	UU PDP Personal Data Protection Law	2022-10-17 (pending implementation)	Pending
🇮🇳 India	DPDP Act 2023	2023-08-11 (pending implementation)	Cross-border transfer restrictions

16. Data Protection Officer (DPO)

To comply with GDPR Articles 37-39:

Data Protection Officer: Guangzhou Tianxingke Network Technology Co., Ltd
Email: txk18122252653@163.com
Response Time: 15 business days

16.5 Regulatory Authorities

Region	Regulatory Authority	Website
🇨🇳 Mainland China	Cyberspace Administration of China (CAC)	www.cac.gov.cn
🇭🇰 Hong Kong	Office of the Privacy Commissioner for Personal Data (PCPD)	www.pcpd.org.hk
🇲🇴 Macau	Office for Personal Data Protection	www.gpdp.gov.mo
🇹🇼 Taiwan	Personal Data Protection Committee	www.pdpc.gov.tw
🇯🇵 Japan	Personal Information Protection Commission (PPC)	www.ppc.go.jp
🇰🇷 Korea	Personal Information Protection Commission (PIPC)	www.pipc.go.kr
🇸🇬 Singapore	Personal Data Protection Commission (PDPC)	www.pdpc.gov.sg
🇲🇾 Malaysia	Jabatan Perlindungan Data Peribadi (JPDP)	www.jpdp.gov.my
🇹🇭 Thailand	Personal Data Protection Committee (PDPC Thailand)	www.pdpc.or.th
🇻🇳 Vietnam	Ministry of Information and Communications / Ministry of Public Security	mic.gov.vn
🇵🇭 Philippines	National Privacy Commission (NPC)	privacy.gov.ph
🇪🇺 EU (general)	European Data Protection Board (EDPB)	edpb.europa.eu

17. Contact Information

Company Name: Guangzhou Tianxingke Network Technology Co., Ltd
Email: txk18122252653@163.com
App Name: tutucash
Version: v1.0.0
Bundle ID: com.tianxingke.tutucash

tutucash Privacy Policy

Table of Contents

1. Introduction

1.5 Scope Extension

2. Information We Collect

2.1 Actively Provided (entered by the Company backend)

2.2 Automatically Collected

2.3 We Do NOT Collect

3. Purpose of Use

4. Multi-Role Permissions

5. Information Sharing

6. Data Storage & Security

7. Cross-Border Data Transfer ⚠️ Critical Section

7.1 Transfer Scenarios

7.2 Legal Basis

7.3 Our Commitments

7.4 Risk Disclosure

7.5 Cross-Border Transfer (Multi-Country Version)

7.5.1 Applicable Employee Distribution

7.5.2 Cross-Border Transfer Specific Measures

7.5.3 Country-Specific Requirements

8. Photo Receipts & Photo Library Access

8.1 What We Collect

8.2 iOS Photo Library Permission Request

8.3 Metadata Contained in Photos

8.4 Photo Storage and Deletion

9. Third-Party Services

9.5 Southeast Asia PDPA Summary (Multi-Country Adaptation)

9.5.1 Singapore PDPA (Personal Data Protection Act 2012)

9.5.2 Thailand PDPA (Personal Data Protection Act B.E. 2562 / 2019)

9.5.3 Vietnam Personal Data Protection (Decree No. 13/2023/ND-CP, effective July 2023)

9.5.4 Malaysia PDPA 2010 (Personal Data Protection Act 2010)

9.5.5 Common Compliance Requirements

10. Your Rights

10.1 Special Note on "Right to be Forgotten"

11. Children's Privacy

12. Automated Decision-Making & Profiling

13. Data Security Incidents

14. Changes to This Policy

15. Governing Law & Disputes

15.5 Southeast Asia Specific Laws

16. Data Protection Officer (DPO)

16.5 Regulatory Authorities

17. Contact Information