1. 我们收集的信息

账号信息：邮箱、显示名称（通过 Clerk 或 ChatGPT 登录获得）。

学习数据：生成的课程、学习事件、练习作答、导师对话、掌握度与复习记录。

你上传的资料：文件、正文与来源网址。

技术与用量信息：AI 调用次数与 Token 用量、错误日志；为防止滥用，我们对未登录访问的 IP 地址做不可逆哈希后计数，不保存原始 IP。

支付信息：由 Stripe 处理；我们仅保存订阅状态、账单金额与 Stripe 客户编号，不保存银行卡号。

2. 使用目的

提供与改进学习服务、生成个性化课程与复习安排、计费与防止滥用、保障安全与履行法律义务。我们不会出售你的个人信息，也不会用你的内容训练我们自己的模型。

3. 委托处理与第三方

为提供服务，我们会将必要数据交由以下服务商处理：OpenAI（AI 生成、资料检索，以及语音导师的实时语音处理；我们不录音、不保存语音）、Clerk（登录认证）、Stripe（支付）、Turso / Cloudflare（数据存储）、Vercel（网站托管）、Resend（复习提醒邮件发送）、PostHog（产品使用分析，仅使用经哈希处理的标识，不记录邮箱）、Sentry（错误监控，如启用）。

上述服务商可能位于中国境外。使用本服务即表示你知悉并同意为提供服务所必需的个人信息出境；我们将按照适用法律（包括马来西亚《2010 年个人数据保护法》以及你所在地的个人信息保护法律）履行相应义务，并与服务商约定数据保护要求。

4. 保存期限

账号存续期间保存你的学习数据；注销账号后 30 天内删除或匿名化，法律法规要求保存的（如账单记录）除外。

5. 你的权利

你可以查阅、复制、更正、删除你的个人信息，撤回同意或注销账号。请通过 info@weareoneconnection.com 联系我们，我们将在 15 个工作日内处理。

6. 未成年人

本服务面向 18 周岁以上用户。未成年人应在监护人同意与指导下使用。

7. 安全

我们采用传输加密、访问控制、最小权限与密钥隔离等措施保护数据。如发生安全事件，我们将依法通知你与监管部门。

8. 联系我们

个人信息控制者：ONEAI LABS SDN. BHD.（公司注册号 202601020394 (1682491-W)，马来西亚）。个人信息保护联系邮箱：info@weareoneconnection.com。

1. Information we collect

Account: email and display name (from Clerk or ChatGPT sign-in).

Learning data: generated courses, learning events, practice answers, tutor conversations, mastery and review records.

Material you upload: files, text, and source URLs.

Technical and usage data: AI request counts, token usage, and error logs. To prevent abuse we count anonymous requests by an irreversible hash of the IP address and never store the raw IP.

Payments: processed by Stripe; we store only subscription status, invoice amounts, and the Stripe customer ID, never card numbers.

2. How we use it

To provide and improve the Service, generate personalized courses and review schedules, bill and prevent abuse, keep the Service secure, and meet legal obligations. We do not sell personal information and do not train our own models on your content.

3. Processors

We share the data needed to run the Service with: OpenAI (AI generation, retrieval, and real-time audio for the voice tutor; we do not record or store audio), Clerk (authentication), Stripe (payments), Turso / Cloudflare (storage), Vercel (hosting), Resend (review reminder emails), PostHog (product analytics using hashed identifiers, never email addresses), and Sentry (error monitoring, when enabled).

These providers may be located outside your country. We transfer personal information across borders only as needed to provide the Service and in line with applicable law, including Malaysia's Personal Data Protection Act 2010, and with data protection obligations agreed with each provider.

4. Retention

We keep learning data while your account exists and delete or anonymize it within 30 days after account deletion, except records we must retain by law (such as invoices).

5. Your rights

You may access, copy, correct, or delete your personal information, withdraw consent, or delete your account by contacting info@weareoneconnection.com. We respond within 15 business days.

6. Children

The Service is intended for users aged 18 or older. Minors should use it only with guardian consent and supervision.

7. Security

We use encryption in transit, access control, least privilege, and secret isolation. We will notify you and regulators of security incidents as required by law.

8. Contact

Data controller: ONEAI LABS SDN. BHD. (company registration no. 202601020394 (1682491-W), Malaysia). Privacy contact: info@weareoneconnection.com.