Privacy Policy

This policy applies to website visitors, business customers, retail customers, distributor applicants, account holders, and other people who communicate with Heyou Global. The registered operating entity is identified by its Chinese legal name, 菏泽市曹县合友贸易有限公司; Heyou Global is the public-facing brand.

Depending on the features used and the information a person chooses to provide, we may process:

• Identity and contact information, such as name, company, role, email address, telephone number, country, and preferred language.
• Account and authentication information needed to provide account features and protect access.
• Inquiry, Quote, product, quantity, specification, compatibility, destination, and after-sales information.
• Customer Support and AI Assistant messages, including images or videos intentionally attached to a conversation.
• Technical and security data, such as device, browser, IP address, session, region, access logs, and abuse-prevention signals.
• Records required to handle an authorized return, warranty review, legal obligation, or dispute.

Do not send passwords, full payment-card details, government identity documents, health information, or unrelated confidential material through an inquiry or AI chat.

We use personal information only where reasonably necessary for the purposes described below:

• Respond to inquiries and prepare requested Quotes.
• Review product specifications, compatibility information, order requirements, returns, and warranty claims.
• Operate accounts, Customer Support, security, fraud prevention, and website functionality.
• Maintain business records and comply with applicable legal, tax, customs, and regulatory obligations.
• Improve website content, products, service quality, and operational processes using proportionate information.

Depending on applicable law and the circumstances, processing may be necessary to respond to a request before entering into a transaction, perform an agreed transaction or service, comply with legal obligations, protect legitimate business and security interests, establish or defend legal claims, or act on consent where consent is required. Mandatory local rights and requirements are not excluded by this policy.

We do not sell personal information. Information may be disclosed only where reasonably necessary to hosting and infrastructure providers, providers used to deliver a feature requested by the user, professional advisers, authorities where legally required, or parties involved in an authorized transaction, claim, or business operation. We do not currently use advertising pixels or optional analytics tools on the production website. The production website does not currently send chat content to an external AI provider. If that changes, this policy will be updated before the feature is enabled.

If you choose Google sign-in, Google is a third-party identity provider. We receive the name, email address, profile picture, and stable Google account identifier (Google sub) that Google makes available for basic identity authentication. We do not request access to Gmail, Google Drive, Google Calendar, Google Contacts, or YouTube, and we do not request sensitive or restricted Google scopes.

We use this Google-provided identity data only to create or sign in to the account, protect account security, prevent abuse, and provide support. We do not sell Google user data. Google processes information under its own privacy terms when it provides the sign-in service.

Google-derived identity data is retained with the account record for as long as reasonably needed for account access, security, support, legal obligations, or disputes. You may use the contact details below to request account or related personal-information deletion, subject to identity verification and records that must be retained for law, security, fraud prevention, or dispute handling.

For a Google sign-in privacy or deletion request, email jianghonglai40@gmail.com.

Heyou Global is operated from China, while website infrastructure may process information in the United States or other locations where infrastructure providers operate. Where applicable law requires safeguards for an international transfer, we will use measures appropriate to the relevant processing and service.

Account, inquiry, Quote, support, security, and related business records are kept for as long as reasonably needed to provide requested services, protect the website, maintain business records, meet legal, tax, customs, warranty, or dispute-handling obligations, or establish and defend legal claims. Chat messages and uploaded attachments are not currently subject to an automatic fixed deletion schedule.

We use measures intended to protect information, including HTTPS transport, access controls, secure and HttpOnly authentication cookies in production, restricted administrative access, upload type and size validation, and operational logging. No internet transmission or storage system can be guaranteed completely secure.

The production website currently uses first-party technologies needed for accounts, registration, carts, caching, region handling, chat continuity, and security.

• _medusa_jwt: authentication token; up to 7 days; HttpOnly, SameSite=Strict for password sign-in or SameSite=Lax for Google OAuth, and Secure in production.
• _medusa_pending_customer: temporary registration details, which may include name, email address, and telephone number; up to 24 hours; HttpOnly, SameSite=Strict, and Secure in production.
• _medusa_cart_id: shopping-cart identifier; up to 7 days; HttpOnly, SameSite=Strict, and Secure in production.
• _medusa_cache_id: cache and region-request identifier; up to 24 hours.

The chat interface stores up to 50 recent messages, the selected chat mode, and a random chat-session token in browser local storage. These items remain until the visitor clears site data or the application replaces them.

Subject to applicable law, you may request access, correction, deletion, restriction, objection, withdrawal of consent, or a portable copy of eligible personal information. We may need to verify identity and retain records required by law, security, fraud prevention, or dispute handling.

For a privacy request, email jianghonglai40@gmail.com.

This website is intended for people able to make legitimate product or business inquiries and is not directed to children. If you believe a child has submitted personal information, please contact us for review.

We may update this policy when business processes, website features, service providers, or legal requirements change. The current version and update date will appear on this page.

For a privacy question, email jianghonglai40@gmail.com.