Privacy Policy
This Policy explains how we collect and use personal data when you visit https://daoyepro.com, leave an optional email notice, use on-page tools, or buy a digital report. It is written for a small provider of digital reports sold through an online reseller serving customers in Singapore, Canada, the United States (including California), and Australia. The United Kingdom and the European Union are not currently open for sale. This Policy is not legal advice.
Notice at collection: At or before you enter personal data (an optional email notice or checkout), we provide this Policy (linked next to the form) so you can see the categories, purposes, sale/sharing status, and retention described below.
When paid checkout is open, this Policy is shown to you before you pay. At checkout you will also be asked to tick a separate box about processing in mainland China and the overseas recipients listed in sections 5 and 6.
1. Data we collect
We collect only what we need for the feature you use. We do not collect a customer name field for any product tier.
(a) Optional email notices. If you ask to be emailed when paid checkout opens for the report you chose, we collect:
- Email address (waitlist) — purpose: to email you when checkout opens for the product you chose. Every email includes an unsubscribe link; if you unsubscribe, we delete your waitlist entry. Retention: 180 days (automatic TTL), then deleted unless you ask sooner.
- Consent (checkbox) and a snapshot of the consent text — purpose: record that you agreed to an optional email notice. Retention: 180 days with that notice record.
- SKU (which product you asked about: BaZi Snapshot / BaZi Life Map / BaZi Year Ahead) — purpose: send the right notice. Retention: 180 days with that notice record.
- Report language (en / zh / zh-TW only, when the notice form offers it) — purpose: produce notices and related messages in the language you select. Retention: 180 days with that notice record. Not placed on the accounting ledger.
- Client IP — purpose: rate limiting / abuse control only. Retention: rate-limit window only. Not stored on the optional email-notice record.
(b) Free BaZi preview — LIVE, browser only Birth date, birth hour and gender typed for the free preview stay in your browser. Gender is used there only to show the direction and starting age of the luck cycles (Da Yun 大运), for entertainment. They are not uploaded to our servers. Retention: N/A.
(c) Self-test quiz — LIVE, browser storage only Quiz answers / result and a language preference may be saved in your browser’s localStorage until you clear site data. We do not upload them.
(c2) Site language suggestion and preference — LIVE now
- Cloudflare may provide a country code header (for example CF-IPCountry) with the request. We may use that country code only to show a non-forced on-page language suggestion (English / 简体中文 / 繁體中文). We do not log that country code together with your IP for this purpose, and we do not use it for advertising profiles.
- Your chosen site language (en / zh / zh-TW) may be stored in your browser’s localStorage after you select it. Purpose: remember your UI language preference. Retention: until you clear site data for this origin. We do not upload that preference as a tracking profile. We do not write localStorage from country code alone — only after you click a language choice.
(d) Paid checkout and report generation — when paid sales open Products (when paid checkout opens): BaZi Snapshot (US$14.99), BaZi Life Map (US$29), BaZi Year Ahead (US$39). Singapore dollar figures on the site are display prices; the currency and price shown at checkout apply. Birth data is collected only at paid checkout, not on optional email notices. On the server we collect:
- Birth date (required) — purpose: generate the Four Pillars entertainment report. Retention: encrypted with the report package; deleted 30 days after delivery. Collected only at paid checkout — not collected on optional email notices.
- Birth time / hour (required) — same purpose and retention. Collected only at paid checkout — not collected on optional email notices.
- Email address — purpose: deliver the report / download link and send receipts. Retention: the copy kept with the report package is encrypted and deleted 30 days after delivery; a separate encrypted copy is kept for 24 months as part of the order evidence record (see (h)). Not kept on the accounting order ledger.
- Report language (en / zh / zh-TW only) — purpose: generate and deliver the entertainment report (and related order emails) in the language you select at checkout. Retention: encrypted with the report package; deleted 30 days after delivery. Not kept on the accounting order ledger. (The language version of the pages you agreed to at checkout is part of the order evidence record, see (h).)
- Gender (required for every report tier) — collected only when paid checkout is open. Purpose: under the traditional rule set our software uses, gender sets whether the ten-year luck cycles (Da Yun 大运) run forward or backward and when they start; BaZi Snapshot shows only that direction and starting age, while BaZi Life Map and BaZi Year Ahead use it for the ten-year luck-cycle overview. Presented for entertainment. Not used for marketing profiles. If you do not choose one, we cannot generate the report. Retention: encrypted with the report package; deleted 30 days after delivery.
We do not collect telephone digits as a report input, free-text question text, or birth place for these products.
Your birth date, birth time and gender (the report inputs), the copies of your email address and report language kept with the report package, and the 7-day download copy of the report are stored encrypted at rest (for example AES-GCM) and automatically deleted 30 days after delivery (7 days if the order is never paid). A separate encrypted copy of the finished report, and your email address, are kept as part of the order evidence record described in (h).
(e) Order and payment information (when paid sales open) Order ID, amount, currency, time, country of purchase, billing country, and the country derived from your IP address. These ledger fields do not include name, email, birth data, gender, or report content (your email address and the payment and refund transaction IDs are kept separately, encrypted, in the order evidence record described in (h)). Card details are collected directly by Dodo Payments, our reseller and merchant of record; we do not receive or store full card numbers. Payment notification IDs used only to prevent double processing are kept for 90 days and contain no personal details; payment and refund transaction IDs that form part of an order evidence record are kept with that record for 24 months (see (h)). Purpose: fulfil the order, prevent double processing, tax and accounting, chargeback defence.
(f) Technical data IP address, browser type, basic device information, and pages viewed, for security, abuse prevention, rough analytics, and (where relevant) tax location evidence. Retention: shorter rolling windows (for example about 90 days) unless we are investigating abuse. This does not apply to the IP addresses recorded each time an order’s download link is used: those are part of the order evidence record in (h) and are kept, encrypted, for 24 months.
(g) Support communications Emails, WhatsApp messages, or X direct messages you send us (for example to daoyeac@gmail.com). Purpose: customer support. Retention: up to 3 years after the last message.
(h) Order evidence records (when paid sales open) For each paid order we keep a tamper-evident record so that we, Dodo Payments (our reseller and merchant of record) and card networks can check what was ordered, agreed, paid and delivered. It contains:
- order ID, product, price and currency, payment and refund transaction IDs, and the times of each step;
- your checkout confirmations (Terms of Service, the entertainment-only / software-generated Disclaimer, the Refund Policy, the China-processing / overseas-recipient box and, for UK or EU orders, the request for immediate supply): which version of each page you saw, a fingerprint of that page, the exact checkbox wording, and the time you ticked each box;
- a copy of the report file we generated for you, its fingerprint and generation time;
- the time our delivery email was handed to our email provider and the delivery status it reports (for example delivered or bounced);
- each time your download link was used: date, time and the full IP address of the request, and whether the file was served;
- support and refund messages about that order.
Your email address, IP addresses and message text in this record are encrypted and stored separately from the rest of the record. Purpose: to fulfil the order, handle refunds, disputes and chargebacks, prevent fraud, and meet our payment provider’s record-keeping requirements. Legal basis (where GDPR-style rules apply): performance of the contract and our legitimate interest in defending payment disputes. Retention: 24 months after the last activity on the order (see section 7).
We do not sell personal information for money. We do not use your report inputs to build marketing profiles.
2. How we use data
We use personal data only to:
- send one optional email notice when paid checkout opens for the report you chose, if you asked for it;
- generate and deliver (download and/or email) the report you ordered, when paid checkout is open (including the luck-cycle direction and starting age, which use gender);
- provide customer support, refunds, and chargeback defence (including delivery logs);
- keep the site secure and prevent abuse;
- meet compulsory tax, accounting, and other legal obligations (including, when UK/EU sales open, VAT location evidence; and Singapore GST location evidence if we become GST-registered under OVR).
We do not use report inputs for advertising profiles, lookalike audiences, or sale to data brokers.
3. Charting and third-party AI
Charts and report text are produced by our own software and open-source libraries running on systems we control (or, for the free preview, in your browser). We do not send your birth data, gender, or other report inputs to any third-party AI model (including large language model APIs) to generate your report.
4. Legal bases (where GDPR / UK GDPR-style rules apply)
Where a law such as the GDPR or UK GDPR applies:
- contract (Article 6(1)(b)): to generate and deliver the report you bought and to support that order;
- legitimate interests (Article 6(1)(f)): security, fraud prevention, rate limiting, limited site integrity, and keeping order evidence records to handle refunds, disputes and chargebacks — balanced against your rights;
- consent (Article 6(1)(a)): optional email-notice consent; and, where required, non-essential cookies;
- legal obligation (Article 6(1)(c)): tax, accounting, lawful requests.
The separate box about processing in mainland China and overseas recipients at paid checkout is collected because Chinese law requires separate consent for providing personal information outside China (see section 6). Where the GDPR or UK GDPR applies, we do not rely on that box as the legal basis for processing your order; we rely on contract, legal obligation and legitimate interests as listed above.
Your email, date of birth, birth time and gender are ordinary personal data for these purposes. They are not treated by us as special-category data under Article 9. Please do not submit special-category content (for example health diagnosis details) in any free-text field. If you do, we use that content only to refuse the request and/or delete it — not to infer health, politics, religion, or similar attributes.
5. Sharing
We share data with processors that help us run the service (hosting, including optional email-notice storage, and email delivery). Processors may only use the data to provide their service to us. When paid checkout is open, we also share order data with Dodo Payments, which sells the report to you as reseller and merchant of record and is an independent controller of the data it handles for that purpose (see section 6). We do not publish report contents.
If an order is disputed or a payment provider asks us to prove delivery, we may share that order’s evidence record (or the parts needed) with Dodo Payments, our reseller and merchant of record, which may pass it to the card network and card issuer handling the dispute. We share only the record for that order.
6. International transfers — processing in China
Personal data you submit through daoyepro.com for paid orders is processed and stored in mainland China by Shanghai Yijinwei Intelligent Technology Co., Ltd. Some processors (for example hosting, notice storage or email providers) may also handle limited data in Hong Kong, the EEA, the UK, the United States, Singapore, or other regions.
Before you place a paid order we tell you that your order data and report inputs are processed and stored in mainland China, and we ask for your separate consent (a box that is not pre-ticked) to provide the information needed to take payment, deliver the report and handle any refund or dispute for that order to the overseas recipients below. This is needed to sell and deliver the report, so a paid order cannot be placed without it. Withdrawing your consent later does not affect processing already carried out.
Overseas recipients:
(1) Dodo Payments Inc., a Delaware corporation (United States), 8, The Green, STE A Dover, County of Kent, Delaware 19901, United States; privacy@dodopayments.com; Privacy Policy: https://dodopayments.com/legal/privacy-policy. Contracting entity: Dodo Payments Inc.
- Role: reseller and merchant of record for your order. It sells the report to you, takes payment, calculates and remits sales tax, issues the invoice and handles refunds and payment disputes.
- Data we provide: order ID, product, price and currency, your email address and report language; in a refund or dispute, the parts of that order’s evidence record that are needed (checkout confirmations, delivery and download logs, the archived report and support messages).
- How it is processed: Dodo Payments uses, stores and may pass on this data as an independent controller under its own Privacy Policy, including within its group, to its payment processors and, in a dispute, to the card network and your card issuer. Its documentation states that its card payment systems are hosted in India.
- Your rights: you can exercise your rights through us (daoyeac@gmail.com) or directly with Dodo Payments (privacy@dodopayments.com).
(2) Email delivery provider: Resend (operated by Plus Five Five, Inc.); location and data-processing location: United States; contact: support@resend.com.
- Role: sends delivery emails and receipts on our instructions.
- Data: your email address, order ID, download link and report language.
- How it is processed: used only to send our emails and kept only as long as our contract with it allows.
- Your rights: you can exercise them through us (daoyeac@gmail.com).
Each recipient receives only the information needed for its role; in a dispute, only that order’s evidence record (or the parts needed). To exercise your rights with an overseas recipient, contact us at daoyeac@gmail.com and we will pass on or help with your request.
Where the GDPR or UK GDPR applies, transfers we make from China to these recipients will use an Article 46 transfer tool or, where appropriate, Article 49(1)(b), (c) or (e).
Safeguards (described generally; certifications are not claimed by name unless we later add them):
- written contracts with processors that limit how they may use the data;
- access control so only staff who need the data for the purposes above can reach it;
- encryption in transit (TLS) and encryption at rest for report packages where practicable (for example AES-GCM);
- where GDPR or UK GDPR applies to a transfer to China, we will use an Article 46-style transfer tool appropriate to that regime (for example EU Standard Contractual Clauses and/or the UK International Data Transfer Agreement / Addendum) when we open UK or EU sales, rather than relying on checkout consent alone for systematic transfers.
- for personal data of individuals in Singapore, we take steps intended to meet the PDPA Transfer Limitation Obligation (PDPA s.26): personal data is transferred outside Singapore only in accordance with prescribed requirements so that a standard of protection comparable to the PDPA applies (for example contractual obligations on the recipient). https://www.pdpc.gov.sg/overview-of-pdpa/the-legislation/personal-data-protection-act/data-protection-obligations; guidance: https://www.pdpc.gov.sg/organisations/resources/guidance-by-topic/guide-to-cross-border-data-transfers.
UK and EU checkout remain closed until those arrangements and, where required, an Article 27 representative are in place.
7. Retention
- Optional email-notice address, consent snapshot, SKU, and report language (if collected): 180 days, then automatic deletion.
- Optional-notice rate-limit IP keys: rate-limit window only.
- Free BaZi preview inputs: not stored by us.
- Self-test localStorage: until you clear it.
- When paid checkout is open — birth date, birth time and gender, the copies of your email address and report language kept with the report package, and the 7-day download copy of the report: stored encrypted and automatically deleted 30 days after the report is delivered (7 days if the order is never paid).
- Order evidence records (section 1(h)) — your email address, the archived copy of the report, the full IP address of each download, your checkout confirmations, payment and refund transaction IDs, delivery-email receipts, and support and refund messages about the order: stored encrypted and kept for 24 months after the last activity on the order, then deleted. If a dispute, chargeback, regulatory inquiry or legal claim about that order is open, we may place the record on legal hold and keep it longer, only until that matter is closed.
- Order records (order ID, amount, currency, time, country of purchase, billing country, IP-derived country; no name, no email, no birth data, no gender, no report content): kept as accounting archives for the minimum periods, as required by the Accounting Archives Management Measures (会计档案管理办法, Order No. 79, issued in 2015 by the Ministry of Finance and the National Archives Administration of China) and its Retention Schedule for Accounting Archives of Enterprises and Other Organisations (企业和其他组织会计档案保管期限表). Under Article 14, retention periods are permanent or fixed-term (generally 10 or 30 years), counted from the first day after the end of the relevant accounting year; under Article 15 the annex periods are minimums. For enterprise accounting vouchers and accounting books, the Retention Schedule sets a minimum of 30 years where applicable. https://www.gov.cn/zhengce/2015-12/11/content_5717189.htm; https://jdjc.mof.gov.cn/fgzd/202204/t20220408_3801693.htm.
- Payment notification IDs used only to prevent double processing: 90 days. Payment and refund transaction IDs that are part of an order evidence record: as for that record (24 months).
- Support emails and messages: up to 3 years after the last message (messages about a paid order are also part of its order evidence record).
- Server logs: shorter rolling windows (for example about 90 days) unless we are investigating abuse. Download IP addresses in order evidence records: 24 months, as above.
8. Security
TLS in transit; access limited to staff who need it; card data handled by PCI-oriented payment providers when checkout is live. Report packages are encrypted at rest (for example AES-GCM). Download links expire 7 days after delivery and can be opened at most 5 times. Report archives kept for free regeneration are stored encrypted and deleted 24 months after the last activity on the order. Order evidence records are append-only: each entry is linked to the previous one with a cryptographic hash and signed, so later changes can be detected; exporting a record is limited to authorised staff. No method of transmission or storage is 100% secure.
9. Your rights (including Singapore PDPA)
Subject to the privacy law that applies where you live, you may have rights to access, correct, delete, and withdraw consent for personal data we hold about you, and to complain to a regulator.
Singapore (Personal Data Protection Act 2012 — PDPA): Where the PDPA applies to our collection or use of your personal data, we will collect, use, and disclose personal data for purposes a reasonable person would consider appropriate in the circumstances and that we have notified, and we will seek consent where the PDPA requires it (for example optional email notices and the separate China-processing / overseas-recipient box at paid checkout). See https://www.pdpc.gov.sg/overview-of-pdpa/the-legislation/personal-data-protection-act/data-protection-obligations. You may request access to or correction of your personal data. Contact: daoyeac@gmail.com (data protection contact for these purposes). We aim to respond within a reasonable time. Transfer Limitation Obligation: see section 6 (transfers to mainland China and comparable protection). Data Breach Notification Obligation: if a data breach is notifiable under the PDPA (for example likely significant harm to individuals, and/or significant scale such as 500 or more individuals), we will assess and, where required, notify the Personal Data Protection Commission and affected individuals as soon as practicable in line with PDPC guidance. See https://www.pdpc.gov.sg/overview-of-pdpa/the-legislation/personal-data-protection-act/data-protection-obligations; https://www.pdpc.gov.sg/organisations/resources/guidance-by-topic/data-breach-management-guide; https://www.pdpc.gov.sg/organisations/e-services/report-your-organisations-data-breach.
Without limiting other rights:
- California (CCPA / CPRA): where applicable — know, delete, correct, and opt out of “sale” / “sharing” as defined by the CPRA. We do not sell personal information for money and we do not “share” it for cross-context behavioural advertising as commonly understood.
- Canada (PIPEDA): access and correct; challenge compliance.
- Australia (APPs): access and correct; complain about handling.
- UK GDPR / EU GDPR (when those markets open): access, rectification, erasure, restriction, objection, portability where applicable; complaint to the ICO or an EU supervisory authority.
Order evidence records: where the law allows, we may keep an order evidence record until its retention period ends even if you ask us to delete it, because we need it to handle refunds, disputes and chargebacks and to meet our payment provider’s requirements. We will still delete your report inputs on the 30-day schedule. This does not prevent you from asking for access to, or a copy of, the personal data in the record.
How to exercise rights: email daoyeac@gmail.com with “Privacy request” in the subject line. Please include the email you used and approximate time so we can verify identity. We aim to respond within 30 days of a verified request (or sooner if a local law sets a shorter period).
Complaints: you may also complain to the privacy regulator where you live (for example PDPC in Singapore — https://www.pdpc.gov.sg/ ; OAIC in Australia; OPC Canada; California Privacy Protection Agency / state AG in the US). Contacting us first often resolves the issue faster.
10. Crisis and sensitive questions
Reports and tools are for entertainment and self-reflection only. They are not medical, legal, financial, or crisis advice.
Please do not submit questions or free text about health diagnosis or treatment, legal outcomes, investment returns, immigration results, or self-harm. If a submission appears to involve self-harm or an immediate crisis, we will not generate a report. Instead we will show help-seeking information.
11. Children
Services are for adults aged 18 and over only. We do not knowingly collect personal data from anyone under 18. If you believe a minor has submitted data, email daoyeac@gmail.com and we will delete it.
12. Cookies
Essential cookies may be required for security and, when open, checkout. If we use non-essential analytics cookies, we will request consent where required. Browser localStorage for the self-test is described in section 1(c).
13. Changes
We will post updates on this page with a new date.
14. Contact
Shanghai Yijinwei Intelligent Technology Co., Ltd. (上海壹津韦智能科技有限公司) Incorporated in Shanghai, People’s Republic of China. Geographical address: Unit A, 5F, Building 2, No. 1588 Qilianshan Road, Baoshan District, Shanghai, China (Unified Social Credit Code: 91310113MAK7XMYG7F) Reseller and merchant of record (when paid checkout is open): Dodo Payments Inc. EU / UK Article 27 representative: Not appointed (UK/EU sales closed) Data protection / privacy contact: daoyeac@gmail.com