Privacy Policy Release & Effective Date: May 29, 2026 Update Date: May 29, 2026 Company Name: Xiamen PurpleZero Supply Chain Co., Ltd. Abbreviation: Zidongling Product/Service: SlimZero mobile application and its extended functions (hereinafter "the app"). This policy applies only to the products and services provided by Xiamen PurpleZero Supply Chain Co., Ltd. (abbreviated as "Zidongling") and its extended functions. If a product has its own privacy policy or user agreement with different terms, that product's policy takes precedence for that product; anything not covered there is governed by this policy. We will not disclose your information to third parties without your prior consent, except as set out in this policy. We may update this policy from time to time. By agreeing to and using the app, you are deemed to have agreed to this policy in full. This policy is part of the app's terms of service. This policy applies to all products and services offered through the app. Before using any product or service, please read and understand this policy, especially terms in bold or underlined. We use plain language where possible to help you understand. This privacy policy covers: I. Definitions and scope II. How we collect and use your personal information III. How we use cookies and similar technologies IV. How we share, transfer, and disclose your information V. How we protect and store your information VI. How to access and manage your information; information security VII. Minors VIII. Other I. Definitions and scope 1. Personal information: information recorded in electronic or other form that relates to an identified or identifiable natural person, excluding anonymized information. 2. Sensitive personal information: information that, if leaked, illegally provided, or misused, may harm personal and property safety, reputation, or lead to discriminatory treatment (e.g. ID numbers, biometrics, bank accounts, location, transaction data). 3. Device information: information related to your device (e.g. model, OS version, unique identifiers such as IDFA/Android ID, network information). 4. Scope of this policy: a) Registration data you provide when signing up (e.g. phone number); b) Device and log information we automatically collect when you use the app (e.g. IP, device type, date/time, crash logs); c) Data we obtain from partners with your consent or as permitted by law; d) Location: when you use location-based features (e.g. address, store range), we may collect and process location data; e) Permissions: we may request device permissions to provide specific features; see Section II for details. The following are not covered by this policy: a) Search keywords you enter; b) Information you publish in the app (e.g. activities, orders, reviews); c) Information about violations and measures we have taken. II. How we collect and use your personal information (1) Types and purposes 1. Registration & login: phone number (for account, login, recovery, verification); profile (nickname, avatar) for display and personalization. 2. Orders & after-sales: shipping details (name, phone, address) for delivery and receipts; order/transaction data for processing, reconciliation, and risk control; support communications for inquiries and disputes. 3. ID verification (if you choose or if required): name, ID number, ID images for verification and compliance. Sensitive; we protect it strictly. Refusal may limit certain services but not basic use. 4. Device & logs: device identifiers (including IMEI, IMSI, device MAC address, SUPI, SUCI, Android ID, OAID, IDFA, serial number, model, OS version, network info, app version—as available on your device and via integrated SDKs); logs (operations, crashes, performance, IP, access time) for stability, diagnostics, security, and analytics; installed-app list: after you agree to this policy, when you use WeChat/Alipay pay or open external links, we or related SDKs may check whether specific apps (e.g. WeChat, Alipay) are installed to launch the client; we do not use the full install list for unrelated purposes. 4.1 Device MAC address (purpose, method, and scope) - Type: device MAC address (including Wi-Fi MAC, Bluetooth MAC, etc., as returned by the OS, device vendor, or SDK). - Purpose: account and transaction security, payment risk control, service stability, and WeChat/Alipay SDK payment/sharing features. - Method: only after you tap Agree on this policy, read locally or processed by integrated SDKs when you use related features; not before consent. - Scope: limited to payment, security verification, Bluetooth devices, diagnostics, and stability as stated in this policy; not for unrelated ads, profiling, or sale. 4.2 Installed-app list (purpose, method, and scope) - Type: installed-app / software install list (typically whether WeChat, Alipay, or similar clients are installed—not your full app list for other uses). - Purpose: detect whether WeChat/Alipay is installed to invoke the client for payment or links; some SDKs may do the same. - Method: only after you agree, when you use payment or external links, queried locally by the app or WeChat OpenSDK Android / Alipay App Payment Client SDK; not before consent. - Scope: limited to payment and link features described here; we do not use the full install list for unrelated purposes. 4.3 Clipboard - Purpose: only when you tap Copy for promo codes, addresses, support email, etc., to write text to the system clipboard for your use. - Method: write-only on your explicit copy action; we do not continuously read clipboard in the background. 5. Location (with permission): address assistance, service area, location features, and coarse location for Bluetooth hardware (e.g. scale) where required by the system. 6. Images & media: images when you upload avatars, feedback, ID verification, or save promo QR codes (with camera/photo permission). We do not primarily collect audio/video; if we add such features later, we will obtain separate consent. 7. Phone number: when you register, log in, bind account, enter shipping info, or verify security. 8. We do not collect: contacts, call logs, calendar, or SMS content; if that changes, we will update this policy and obtain consent. (2) Permissions (with consent): camera; photo library; storage; notifications; Bluetooth (for scales); location (see above). You can manage these in system settings. (3) Foreground, background & silent states: we do not collect personal information or request sensitive permissions before you agree (except as required by law). After consent, collection occurs when you use features; in background/silent state we and SDKs generally do not exceed what is necessary. Background processing (push, order sync, crash monitoring, payment callbacks, Bluetooth) stays within what is disclosed here. (4) Exceptions where consent is not required We may collect/use information without consent where required by law, e.g. national security, public safety, public health, crime investigation, contract performance, product security, or other statutory exceptions. III. Cookies and similar technologies We may use cookies, identifiers, and local storage to maintain preferences, login state, security, and for analytics. You can manage or delete these; refusing may affect some features. IV. Sharing, transfer, and disclosure (1) Sharing: We do not sell, rent, or trade your personal information to unrelated third parties except: with your consent; to provide requested services; as required by law or authorities; to protect our and users' rights (e.g. fraud prevention); or with affiliates (under similar protection). We may share with: payment providers; logistics; cloud/SMS/push providers; support and ticketing; analytics and crash monitoring. (2) Third-party SDKs: We integrate the following SDKs (among others): 1. WeChat OpenSDK Android (com.tencent.mm.opensdk) - Developer: Shenzhen Tencent Computer Systems Company Limited (深圳市腾讯计算机系统有限公司) - Purpose: WeChat sharing, login, and payment (invoking the WeChat client) - Data collected: device MAC address, Android ID, OAID, other device identifiers, network info, installed-app list (to detect if WeChat is installed), transaction-related info, etc. (see the SDK provider's official policy) - SDK privacy policy: https://support.weixin.qq.com/cgi-bin/mmsupportacctnodeweb-bin/pages/RYiYJkLOrQwu0nb8 2. Alipay App Payment Client SDK (com.alipay.sdk) - Developer: Alipay (Hangzhou) Information Technology Co., Ltd. (支付宝(杭州)信息技术有限公司) - Purpose: Alipay payment (invoking the Alipay client) - Data collected: device MAC address, Android ID, OAID, other device identifiers, network info, installed-app list (to detect if Alipay is installed), transaction-related info, etc. (see the SDK provider's official policy) - SDK privacy policy: https://opendocs.alipay.com/open/54/01g6qm#%E6%94%AF%E4%BB%98%E5%AE%9D%20App%20%E6%94%AF%E4%BB%98%E5%AE%A2%E6%88%B7%E7%AB%AF%20SDK%20%E9%9A%94%E7%A7%81%E6%94%BF%E7%AD%96 We also use package_info_plus for app version/update checks; image_picker/image_cropper for images you select; Bluetooth SDK for scales; app_badge_plus for badges/notifications. Processing stays within purposes disclosed in this policy. (3) Transfer: We do not transfer your personal information except with your consent or in mergers/acquisitions where the recipient is bound by this policy (or we obtain consent again). (4) Public disclosure: We do not disclose your information publicly without your consent or unless required by law; then we use appropriate safeguards. V. Protection and storage (1) We use reasonable measures (access control, encryption, audits, etc.). The internet is not 100% secure; please protect your account and password. (2) Storage: We operate and store data in the People's Republic of China; cross-border transfer will follow law and your consent where required. We retain data only as long as necessary; then we delete or anonymize. (3) Incidents: In case of a security incident, we will notify you and report to authorities as required by law. VI. Access, management, and security (1) You can access and update your account info in the app. You may request deletion where the law allows; we will process after verifying your identity. (2) You can withdraw consent via system settings (permissions, notifications). Withdrawal does not affect the lawfulness of prior processing. (3) Account closure: You can request closure via the app (e.g. Profile / Account / Deactivate). After closure we delete or anonymize your information as required by law, with limited exceptions. (4) If you notice unusual account activity or a possible leak, contact us via in-app Feedback/Support. VII. Minors The app is mainly for adults. If you are under 18, use the app and submit personal information only with a guardian's consent and guidance. We protect minors' information as required by law. VIII. Other 1. This policy is governed by the laws of the People's Republic of China. 2. Disputes shall first be resolved by negotiation; failing that, they may be submitted to a court with jurisdiction where the company is located. 3. Contact: For questions or suggestions, use the in-app Feedback/Support.