PABLO App Privacy Policy

1. Employee login and business access

When you request a verification code or log in, we process your mobile phone number, verification code and verification result to confirm your identity and prevent unauthorized account use. Our backend sends verification messages through Alibaba Cloud SMS. The SMS service processes the recipient phone number, message content and delivery result.

Based on your employee relationship, the backend returns the necessary employee identifier, tenant and dealer identifiers, name or nickname, dealer display information, roles and access permissions to the App. We use this information to display your identity, keep dealer information separate and control business access. Your dealer or a platform administrator manages changes to employee relationships and access permissions.

We use access and refresh credentials to maintain your session. The iOS / iPadOS client stores these credentials in the system Keychain. Logging out ends your App login session; it does not close your employee account or delete server records.

2. Browsing, caching, saving and sharing materials

When you browse products, images, project examples or videos, the App requests the corresponding resources from our backend and static content services. To deliver content, maintain security and investigate faults, these services may process necessary connection information such as network addresses (including IP addresses), request paths and times, and request results. Image and video caches are stored in the application sandbox to improve loading and may be cleared by the system.

When you choose to save or share materials such as videos, the files are handled by the system file, photo or sharing interface and the destination you select. Saving to the photo library uses add-only permission and does not allow the App to read your existing photos. You manage any files you save separately. After you share content with another app, the recipient handles it under its own rules. Please save or share only materials you are entitled to use.

The App does not provide advertising or personalized advertising functions, and we do not require permission for cross-app advertising tracking as a condition of using it. Please also consult the relevant webpage notices for the scope of processing by third-party websites.

3. AI assistance and consent management

AI assistance for company materials is optional. After you explicitly agree to the data processing notice and choose to send a message, your question, relevant history from the current conversation and any speech transcript you confirm for sending are transmitted through our backend to Alibaba Cloud Model Studio (Bailian) to retrieve company materials and generate an answer. If your question contains personal information, that information is transmitted with the content. Please do not enter customer personal information, sensitive personal information, works you are not authorized to use or trade secrets.

Giving consent does not automatically send a question you have already drafted. Declining consent does not affect access to other materials. You can withdraw consent under "Personal Center - AI Data Consent". After withdrawal, the App will not initiate new AI requests and will stop related requests currently in progress in the App. Withdrawal cannot recall data already sent and does not mean that records held by servers or service providers are immediately deleted. You can send a deletion request to our privacy email address.

Alibaba Cloud Model Studio retains data generated by model and application calls in accordance with its privacy notice and applicable law. See the third-party services section for its processing rules. This policy does not promise zero retention by third parties. AI answers may be inaccurate; please check them against the original materials.

4. Voice input

Only after you choose voice input and grant microphone and speech recognition permissions does the App use Apple Speech to turn your speech into a text draft. Recognition may take place on your device or use Apple online services, depending on the device, language and system service availability.

The App currently does not send raw voice recordings to Alibaba Cloud Model Studio. Recognized text is not sent automatically. It is handled through the AI assistance process only after you review it and tap send. If you decline or withdraw the relevant system permissions, you can still type your question.

5. Recorded factory video and live video in earlier test versions

In the initial App Store release, version 2.9.0 (build 14), Factory Recordings uses the system media player to show previously recorded videos. This version does not include the EZVIZ Open Platform audio and video SDK, obtain factory monitoring devices or live playback sessions, or connect to the EZVIZ live video service. Watching recordings does not require local camera, location or device network setup permissions.

Earlier iOS test versions with live video obtained authorized devices and playback sessions from our backend after the relevant business access and separate consent had been granted, and used the EZVIZ SDK to play factory monitoring footage without activating the local camera or using device network setup, location or intercom functions. Section 8 retains the provider and data information for that historical test function; it does not mean that the initial App Store release still uses the SDK.

Recorded factory videos are previously recorded materials, not live monitoring footage. Playback follows the material-browsing and video-request process. Stopping viewing stops local playback; it does not delete videos or connection records held by material services. Please do not distribute factory video or use it for other purposes without authorization.

6. PAI Design, Dreamer and external webpages

The initial App Store release, version 2.9.0 (build 14), retains the PAI Design and Dreamer entries, which open their respective 3vjia websites in the system browser. Neither the websites nor their login pages are embedded in the App. Third-party account details, passwords, uploaded materials and design works that you submit in the browser are processed by the corresponding third-party website. Please read the privacy policy and terms available on its login or service pages.

This initial release does not obtain 3vjia passwords from our backend or automatically fill third-party login details. It does not collect in the App the credentials you enter on the 3vjia website, or store that website's cookies and login sessions. Logging out of PABLO does not log you out of a third-party account in the system browser. You can manage the login and website data on the relevant website or in the browser.

Earlier iOS test versions that embedded the 3vjia webpage used isolated website data stores for different employee login sessions and did not obtain passwords from our backend for automatic entry. That historical implementation does not apply to the initial release described above. In any version, clearing local or browser website data does not close a third-party account or delete design works on third-party servers. When you follow external links to websites or technical materials, the relevant website and browser handle network requests, cookies and other website storage under their own rules. Please check the destination and any permission prompts.

7. System permissions and the effect of declining

Permissions are used only for the corresponding functions you actively choose; they are not a prerequisite for browsing other materials. You can manage granted permissions in iOS / iPadOS system settings. If a third-party webpage requests additional permissions, refer to the specific page and system prompts. This policy does not replace any separate authorization that is required.

Microphone

Requested when you choose voice input, to capture speech for transcription. If you decline, recording is unavailable, but you can still type.

Speech recognition

Requested when you choose voice input, to turn speech into a text draft. If you decline, transcription is unavailable, but you can still type.

Add to the photo library

Requested when you choose to save a video and the system requires this permission. If you decline, you cannot use this method to save to Photos, but you may choose other available system save options. This permission does not allow the App to read existing photos.

8. Third-party services and information processing

We use the following services to the extent necessary for the relevant functions. Service providers may act as entrusted processors or process information when independently providing their own services. They are responsible for the protections required by applicable law and the relevant service arrangements. Consent is managed separately for optional functions. If we add a recipient or change a processing purpose, we will provide a further notice as required by law and obtain renewed consent where necessary.

Apart from sharing you actively choose, processing required by law and the services described in this policy, we will not use personal information for purposes inconsistent with those disclosed. When legally required to assist competent authorities, we provide information only within the scope of the relevant requirement.

Alibaba Cloud SMS | Verification message delivery

Technical service: Alibaba Cloud SMS. Processes phone numbers, verification message content and delivery status. Our backend calls the service to send messages and confirm results; an SMS SDK is not directly embedded in the App. The official general agreement identifies Alibaba Cloud Computing (Beijing) Co., Ltd. as the communications technology provider and Alibaba Cloud Computing Co., Ltd. as the provider of pre-sales and sales-stage consultation.

Communications capability technical service agreement (Chinese)

Alibaba Cloud infrastructure and object storage | Backend and material delivery

Provider: Alibaba Cloud. Hosts the business backend and public materials, processing necessary business data, resource requests, IP addresses, request times and connection logs according to the service. For the data processing rules for object storage, see the storage service agreement of Alibaba Cloud Computing Co., Ltd.

Alibaba Cloud storage service agreement (Chinese)

Alibaba Cloud Model Studio (Bailian) | AI assistance

Provider: Alibaba Cloud. Through our backend, processes questions you actively send after giving consent, relevant conversation history and transcripts you confirm for sending. It is used for material retrieval, inference and answer generation. The provider retains related call data in accordance with applicable law.

Alibaba Cloud Model Studio privacy notice

Apple Speech | Speech-to-text

Provider: Apple. Uses system speech services to process speech you actively provide and its transcription; online recognition may be used. Declining permission does not prevent typing. This App does not send raw voice recordings to Model Studio.

Apple speech privacy notice (including speech recognition in third-party apps)

EZVIZ Open Platform audio and video SDK | Factory preview in earlier test versions only

The initial App Store release, version 2.9.0 (build 14), does not include or call this SDK. The following information is retained only for earlier iOS test versions with live video: the provider is Hangzhou EZVIZ Network Co., Ltd. The SDK and EZVIZ services process factory monitoring device identifiers and necessary verification information, monitoring audio and video, network connection status and IP addresses, client runtime information such as system and language, and playback diagnostics such as error codes and operation times, for identity verification, audio and video connections, playback and troubleshooting. Device network setup, location and intercom functions are not used for factory preview.

EZVIZ SDK privacy policy (historical function reference)

3vjia web service | PAI Design and Dreamer external links

Provider: Guangdong Sanweijia Information Technology Co., Ltd. In the initial App Store release, version 2.9.0 (build 14), PAI Design and Dreamer only open its websites in the system browser. The App does not embed those webpages or collect website account credentials. After you visit a website, the third-party website processes account credentials, design materials and works, network connection information and website sessions under its own policy. Section 6 describes embedded webpages in earlier iOS test versions. Where a particular product has a separate policy, consult the notice on the relevant service page. Logging out of PABLO does not log you out of or close the third-party account.

3vjia privacy policy (Chinese)

9. Retention, processing locations and security

We determine retention periods for different types of information according to the processing purpose, the duration of the account and business relationship, security and dispute-resolution needs, and applicable law. We retain information only for as long as necessary for the relevant purpose; records subject to legal retention requirements are handled accordingly. Employee identity and permission information maintain business accounts, while local credentials, preferences and caches support login and normal browsing.

Logging out does not close your account or automatically delete separately saved files, server-side business records or content held by third-party services. Security logs, audit records and backups are managed separately, and their retention and deletion mechanisms differ from those of local caches. Backups are not immediately overwritten when you log out.

You can request deletion or account closure through our privacy email address. We will verify and handle the request in accordance with applicable law. If a legal retention obligation or a technical reason temporarily prevents deletion, we will explain the reason and handling arrangements and restrict further processing as required by law. Accounts, works and records held by third-party services follow the rules of the relevant service. We will help you exercise your rights within the scope of our responsibilities.

Our backend API instance for employee login and access management is deployed in Beijing, China. Third-party services process data according to their actual service configurations and privacy rules; this does not mean that every third party operates in the same location. Where an international transfer of personal information requires legal procedures, we will disclose the overseas recipient, processing purposes and methods, types of information, and ways to exercise your rights, complete the applicable procedures and obtain any necessary separate consent. This policy is not a blanket authorization for international transfers.

We use access controls, session management and transmission safeguards appropriate to our business. Local login credentials are stored in the system Keychain, preferences and consent versions in application settings, and caches in the application sandbox. Please protect your device and login information and do not share verification codes. No technical measure can guarantee absolute security. If a personal information security incident occurs, we will take remedial action and provide notices and reports as required by law.

10. Your rights and how to contact us

You can view basic identity information and manage AI data consent in Personal Center, and manage microphone, speech recognition and photo permissions in system settings. You can also contact your dealer administrator to correct your employee relationship, or email contact@paboluo.cn to request access to, a copy of, correction or deletion of personal information, account closure, withdrawal of consent, or an explanation of processing rules.

To prevent impersonation, we may ask for the information necessary to verify your identity and the scope of your request. We will not ask you to email a login password, SMS verification code, a complete identity document or information unrelated to the request. We will handle your request promptly in accordance with applicable law and notify you of the result. If we cannot fulfill a request, we will explain why and identify available next steps.

Withdrawing consent does not affect processing already carried out under valid consent before withdrawal. Closing an employee account, ending an employee relationship with a dealer and legally retaining business records are handled separately. The fact that an administrator created your account does not affect your own right to make a personal information request under applicable law.

Privacy contact

Operator: PABLO Furniture Hebei Co., Ltd. Please briefly describe the function you used, what you are requesting and a convenient way to contact you. Avoid attaching unnecessary sensitive information.

contact@paboluo.cn

11. Protection of minors

The App is a business tool for dealer employees and is not intended to provide services to children. If you believe we have improperly processed personal information relating to a minor, the individual or their guardian can contact us at the email address above. We will investigate and handle the matter in accordance with applicable law.

12. Changes to this policy

We may update this policy when functions, service providers or legal requirements change, and will indicate the version and date on the policy page. When a change to processing purposes, methods, information categories or another matter materially affects your rights, we will notify you appropriately as required by law. Functions that require renewed consent will ask for it again. We will not treat continued browsing of other materials as consent to new processing.