Privacy Policy

1. Introduction

This Privacy Policy explains how Shanghai Wuyan Consulting Management Co., Ltd., a company registered in Shanghai, China, referred to in this Policy as "Lantway", "we", "us", or "our", collects, uses, and protects the information you provide when using our website, services, and content.

The Lantway website, services, and content (collectively, the "Service") are specifically designed for foreign nationals planning to travel to, or currently staying in, Mainland China. If you are a citizen of the People's Republic of China (including residents of Hong Kong, Macao, and Taiwan), please be advised that the Service is not intended for your use.

This policy is effective as of December 23, 2025.

2. Information We Collect

A. Information You Provide to Us

• Account Information: When you register, we collect your email address and a securely hashed password. If you choose to sign up via Google, Facebook, or Outlook integration, we only request and retain your email address for account identification.
• Trip Information: To provide an entry assessment, we collect the travel parameters you select in our forms. This information is used only to generate your result in real-time. We do not store your trip information in a way that directly identifies you, but you can choose to save it in your browser's local storage. To improve the Service, we may retain a de-identified copy of trip data for aggregate statistical analysis. Assessments are generated using rule-based logic and are not stored on our servers.
• Contact Information: When you contact us via email or our contact form, we collect your name and email address in order to respond to your inquiry and provide you with support.
• Payment Information: We process your payments through the third-party platform Paddle. We do not collect or store your sensitive payment details, such as credit card numbers or bank account information. We receive payment confirmation information related to your Paid Plan status, and may retain limited billing details (e.g., country of residence) for tax compliance purposes.

B. Information We Collect Automatically

• Service Usage & Quota Information: When you use our paid features (the "Pro" features), our systems automatically track your usage to administer your Paid Plan. This includes recording the number of assessments you generate and the timestamps of these requests to manage your Pro usage limits and quota. Note that while we track when and how many times you use these Pro features, we do not link the specific content of your queries to your user account.
• Authentication & Session Information: After you log in, we store a unique user identifier in a secure cookie in your browser. This is a Strictly Necessary Cookie used to maintain your login state during your visit and avoid repeated logins. We do not use this for cross-site tracking or advertising.
• Device & Technical Log Information: To maintain the normal operation and security of the Service, our hosting platform, Vercel, may automatically collect some basic technical information, such as your IP address, browser type, and access times. For detailed information on how they process this data, please refer to their official privacy policy at https://vercel.com/legal/privacy-policy.
• Analytics & Performance: We may use privacy-focused tools (such as Vercel Analytics) to understand how visitors interact with the Service. These tools are configured to collect aggregated, anonymized data and, by default, do not use persistent tracking cookies that identify you personally. To the extent that any non-essential cookies or similar tracking technologies are deployed in the future or in specific jurisdictions, we will obtain your prior consent in accordance with applicable laws.

3. How We Use Your Information

• To Provide Core Services: We use your trip information to generate your entry assessment result. We use your account information to verify your identity, grant you access to paid content, and track your Pro feature usage to administer your Paid Plan limits.
• To Provide Policy Updates: During your active Paid Plan, we may notify you of updates to official policies, regulations, and requirements via email. These updates are provided for your convenience, and you may opt out of these notifications at any time.
• To Process Transactions: We use your payment confirmation information to manage your Paid Plan status.
• For Communication and Support: We use your contact information to respond to your questions and requests.
• For Service Improvement: We use the de-identified copy of trip data described in Section 2 for aggregate statistical analysis to understand usage trends and improve our services. We apply technical measures to ensure that this statistical data is processed in a manner designed to prevent it from being traced back to any individual.

4. How We Share and Disclose Information

We respect your privacy and do not sell your personal information. We only share or disclose information with third parties in the following limited circumstances:

• Service Providers: We rely on the following third-party services to operate Lantway. They are only authorized to access the information necessary to provide services to us and are contractually obligated to protect your information.
  • Vercel: Our website hosting platform.
  • Supabase: Our database and authentication service provider. Your account information is securely stored on Supabase's infrastructure. Additionally, the de-identified trip data we use for statistical analysis is stored here. We reiterate that trip details are not stored in a way that can be linked to your personal identity. Supabase processes your data in accordance with their privacy standards and helps us manage user authentication and database storage.
  • Paddle: Our payment and Paid Plan management partner. Paddle acts as the Merchant of Record for all our sales; we share necessary information with Paddle to process your transactions and ensure tax compliance.
• Third-Party Links & Affiliates: The Service may contain affiliate links. We may earn a commission from these links at no additional cost to you. We do not share your personal information with these partners. When you click on a third-party affiliate link, that third party may place a cookie on your browser to identify the referral source and process commission settlements. The operation of these cookies is governed by the respective third party’s privacy policy.
• Referral and Introduction Services: If you request an introduction to third-party providers (such as travel agencies), we will only collect and share your necessary information with your separate and explicit consent. This information typically includes your name, email address, and the specific parameters relevant to your inquiry required to facilitate the requested service. This data is handled through secure communication and is not stored on our website’s database.
• Legal Requirements: We may disclose your information if required by law, court order, or governmental request.
• Business Transfers: If the company is involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction.

5. Data Security

We implement industry-standard security measures to protect your information, including the use of HTTPS (SSL) to encrypt all data transmissions and secure hashing for user passwords. We rely on platforms with robust security infrastructures, such as Vercel, Supabase, and Paddle, to ensure the safety of your data.

In the event of a data breach, we will take immediate remedial action to mitigate the impact. We will notify affected users and the relevant regulatory authorities as required by applicable laws.

6. Data Retention

We retain your personal information only for as long as is necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. The specific retention periods are as follows:

• Account & Usage Information: We will retain your account information and associated Pro feature usage records for as long as your account remains active. Upon your request for account deletion, we will delete or anonymize your information as described in Section 8.
• Contact Information: We may retain records of our communications with you, such as support inquiries, for up to one year to provide consistent support.
• Transaction Information: To comply with our legal, tax, and accounting obligations, payment confirmation information related to your transactions may be retained for up to 7-10 years.

7. International Data Transfers

To ensure global accessibility and performance for our international user base, our website and data storage are hosted on infrastructure located outside of Mainland China.

Accordingly, to provide the Service, your personal information will be processed in countries outside of your country of residence, including the United States, where our key service providers are based. We ensure such transfers are conducted lawfully. We do this by entering into Data Processing Addendums with our service providers that incorporate the European Commission's Standard Contractual Clauses (SCCs), and by relying on our U.S. providers' certification under the Data Privacy Framework (DPF), which provides adequate protection for your data.

8. Your Rights

Depending on your region, you have specific rights regarding your personal information. These rights typically include:

• Right to Access & Export: You have the right to access and receive a copy of the personal information we hold about you.
• Right to Rectification: You have the right to ask us to correct any inaccurate information.
• Right to Erasure: You have the right to request the closure of your account and the deletion of your personally identifiable information.

To exercise these rights, please contact us at contact@lantway.com. If a deletion feature is available in your account settings or dashboard, you may also use it to delete your account directly. In either case, your account will be deactivated, and your personally identifiable information (such as your email) will be permanently deleted or anonymized. Please note that we may be required to retain certain information, such as non-sensitive transaction records (e.g., payment confirmations from Paddle), to comply with our legal, tax, and accounting obligations.

9. Information for Users in Certain Regions

We recognize that users in different regions have specific privacy rights. This section outlines these rights.

A. For Users in the European Economic Area (EEA) and the United Kingdom (UK)

If you are a resident of the EEA or UK, you should know the legal basis for processing your personal information. As the "Data Controller" of your personal information, Lantway's legal bases for processing are as follows:

• Performance of a Contract: When you create an account and use our core services, we process your account and authentication information to fulfill our agreement with you.
• Legitimate Interests: We process your de-identified trip data and anonymized technical data (including via Vercel Analytics) to monitor and improve our services, and use your contact information to respond to your inquiries based on our legitimate interests. You have the right to object to such processing. We believe these activities are in our legitimate interest to provide a high-quality, secure user experience and do not override your fundamental rights and freedoms. If you believe that our processing of your personal data infringes data protection laws, you also have the right to lodge a complaint with your local data protection authority.
• Legal Obligation: In some cases, we may need to process your information to comply with a legal obligation.

You also have specific rights granted by the GDPR, including the right to object to our processing of your data based on legitimate interests and the right to lodge a complaint with your national data protection authority.

B. For Users in California

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

• Categories of Information: In Section 2, "Information We Collect," we have detailed the categories of personal information we have collected over the past 12 months.
• "Do Not Sell or Share" Promise: We do not "sell" your personal information for monetary or other valuable consideration, nor do we "share" your personal information for cross-context behavioral advertising, as defined by the CCPA/CPRA.
• Service Providers & Referrals: We disclose data to service providers for essential business purposes (as described in Section 4). Additionally, any data shared via our "Referral and Introduction Services" is performed only at your request and with your explicit consent, and is not considered a "sale" or "share" for advertising purposes.
• Your Rights: You have the "Right to Know" and the "Right to Delete," which are detailed in Section 8, "Your Rights."

C. Information for Users Regarding Chinese Laws (PIPL)

As Lantway is operated by a company registered in Shanghai, China, we observe the relevant principles of personal information protection as outlined in the Personal Information Protection Law (PIPL).

• Data Infrastructure & Global Access: To ensure seamless access and security for our international users (including foreign nationals traveling to or residing in China), all personal information is collected and stored on servers located outside of Mainland China via our service providers, Vercel and Supabase. Where required by applicable laws, we will obtain your separate consent for cross-border data processing.
• Data Minimization & De-identification: In alignment with data protection principles, we collect only the minimum information necessary (e.g., your email for account access). We track query counts for quota management; however, the specific details of your assessment inputs are processed and retained only in a de-identified format for statistical analysis, ensuring they cannot be traced back to your identity. The resulting assessment reports are not stored on our infrastructure. For your convenience, you can choose to store your inputs locally on your own device for repeated queries.
• Your Rights: Regardless of your location, we provide you with the ability to exercise rights of access, correction, and deletion of your personal information, as detailed in Section 8 ("Your Rights").

10. Children's Privacy

The Service is not directed to children under the age of 18. We do not knowingly collect personally identifiable information from children under 18. If we become aware that we have inadvertently collected such information, we will take immediate steps to delete it from our records.

11. Changes to This Privacy Policy

When we make significant changes to this Privacy Policy, we will post a notice in a prominent location on our website and may notify you via the email address associated with your account. For minor adjustments, we will only update the 'Last Updated' date at the top of this page.

12. Contact Us

If you have any questions, comments, or wish to exercise your privacy rights, please do not hesitate to contact us:

• Email: contact@lantway.com (Primary contact method)
• Registered Entity: Shanghai Wuyan Consulting Management Co., Ltd.
• Registered Address: Rm 6735, 6F, Bldg 22, 85 Mingnan Rd, Songjiang Dist, Shanghai 201613, China