Privacy Policy

EngineAI Privacy Policy

Update Date: June 15, 2026

Effective Date: June 15, 2026

Introduction

Welcome to visit and use the products/services provided by EngineAI Robotics Technology Co., Ltd. (hereinafter referred to as “EngineAI” or “we”). This Privacy Policy applies to the products and services (hereinafter referred to as “this Service/this Product”) we provide to you through online and offline scenarios such as the website (engineai.com.cn), EngineAI Robot WeChat official account, EngineAI Embodied Intelligent Robot, etc.

When you use our services, we may collect and use your relevant information. We hope to explain to you through this Privacy Policy how we collect, use, store, and share this information when you use our services, as well as the ways we provide you to access, update, control, and protect this information. This Privacy Policy is closely related to the services you use. We hope you will read it carefully and, when necessary, make the choices you consider appropriate in accordance with the guidance of this Privacy Policy.

We strive to use concise and straightforward language for the relevant technical terms involved in this Privacy Policy to facilitate your understanding.

If you are EU/EEA Users, in the personal information processing activities described in this Privacy Policy, EngineAI acts as the Data Controller. We are responsible for determining the purposes and means of processing personal information and bear responsibility for compliance with the GDPR and other applicable data protection laws. When we engage third-party service providers (such as cloud service providers) to process your personal information on our behalf, such third parties act as Data Processors.

Where required under applicable law (GDPR/CCPA and any other applicable laws), we will obtain your consent or rely on other legal bases before processing your personal information. You may withdraw your consent at any time, and such withdrawal shall not affect the legality of previous processing.

If you have any questions about this Privacy Policy or related matters, please contact us through the contact information.

1. Information We Collect and Use

When we provide services, we may collect, store, and use the following information related to you. If you do not provide the relevant information, you may not be able to register as our user, enjoy certain services we provide, or achieve the intended effects of the relevant services.

We adhere to the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, storage limitation, integrity, and confidentiality, and disclose to you in accordance with the law that the categories of personal information we collect include identity information, contact information, device information, location information, log information, and interaction data (image/voice); it is only used for service provision, customer communication, security assurance, and compliant operation.

1.1 The information we collect and use through our online products (websites and WeChat official accounts)

• When using the “Subscribe to Us” feature, you need to provide us with your email address so that we can send you subscription messages; (Legal Basis: Consent)

  
  

• When using the “Cooperation Consultation” function in “Contact Us”, in order to respond to your cooperation needs and get in touch with you, you need to provide us with your name, company name, industry, contact phone number, email address, cooperation content (optional), and requirement description (optional). (Legal Basis: Contract Performance / Pre-contractual steps)

  
  

• You can download product manuals, technical documents, user manuals, robot supporting software, etc. on your own within the service. During this process, in order to conduct statistical analysis on the downloaded data, we will collect your download records. (Legal Basis: Legitimate Interests).

  
  

• When you use the “Maintenance Appointment” function, for overseas after-sales and maintenance support, we primarily provide on-site repair services and remote software support, and official online maintenance appointment forms on the website are not used by overseas customers. When providing overseas after-sales services, we may collect service type, company name, date of receipt, product model, requested accessories, fault description, photos/videos of the robots, and contact information (name, phone number) to respond to your maintenance needs. To comply with cross-border data protection regulations, we do not recommend that overseas customers return robots to China for repair. (Legal Basis: Contract Performance / Pre-contractual steps).

  
  

• When you fill out the registration information on the corresponding page of “URKL Global Humanoid Robot Free Fighting League and Other Competitions Registration”, in order to record and review your registration information and contact you, we need to collect the competition category, business license of the enterprise, team name, name of the affiliated unit, information of the team contact person (including name, position, contact information, email address), uploaded team information registration form (including the number of team members, names, ages, schools, majors, contact information, division of responsibilities, personal profiles, screenshots of proof materials for enrollment/employment of the team captain and members), project overview, project achievement proof materials (Demo/actual demonstration video link), authorization letter for organizing event participation, and your answers to the open-ended questions related to the event that you input/select in the form involved on this page. When providing us with other people’s personal information, please ensure that you have obtained the authorization and consent of the relevant personal information subject. To avoid doubt, such information is collected via Google Forms for the purpose of arranging your visit and communicating with you. When you provide personal information of other persons, you shall confirm that you have obtained their prior authorization and consent. (Legal Basis: Contract Performance / Pre-contractual steps)

• When you use our services, log information (including your device information (robot device name), click information (click behavior log), and operation log) may be collected by the system through cookies, identifiers, and related technologies, and be stored to provide you with a better user experience and ensure service security. (Legal Basis: Legitimate Interests)

1.2 The information collected and used in the scenarios where you use the robot

• When you use the robot products, related hardware devices, and services developed and operated by us, the robot needs to collect image data, video data,  voice interaction data to respond to your operation requests. When you use the “Control Center” feature, we will collect your approximate geographical location information to link the robot. In addition, the robot needs to collect data during the device operation process (including processed data: recognition results, behavioral decisions) to ensure usage safety. Currently, such information and data are processed locally on the robot product terminals and will not be collected, stored or uploaded to the cloud servers of EngineAI or any third parties. If the future product functions involve the processing of personal information, EngineAI will update this Privacy Policy in accordance with applicable laws and regulations.

• When you use the “Feedback” function, we will collect the error code, possible problem screenshots, and local log package that you actively provide. (Legal Basis: Legitimate Interests)

1.3 Use of Cookies and Similar Technologies

To ensure the smooth operation of this service, we, as the data controller, will use cookies and similar technologies, such as pixel tags and web beacons on our official website. With the help of cookies, the website can store your preference data to help you have a more convenient access experience, and also help us better understand user behavior, tell us which parts of this service users have browsed, measure the effectiveness of our service, and make improvements. We will not use cookies for any purpose other than those described in this Privacy Policy.

We use different types of cookies and similar technologies (pixel tags, web beacons): necessary cookies are essential for basic functions and do not require your consent; non-necessary cookies, which include preference, analytical, and marketing cookies, require your active consent.

When you first visit our website, you will be presented with a cookie banner allowing you to accept, reject, or customize your cookie preferences. You can give or withdraw your consent at any time through our cookie preference center. Rejecting non-necessary cookies will not prevent you from using the core functionality of the website. You can also manage or delete cookies according to your preferences. The way to manage or delete cookies is: Browser Tools → Options → Privacy/Advanced → Manage/Delete Cookies. The setting paths may vary slightly for different types or versions of browsers.

2. Our Legal Bases for Processing

We collect and use your personal information when we have a legal basis to do so. These legal bases include:

• Contract Performance: where processing is necessary to perform our contract with you to provide our products and services, or take steps at your request prior to entering into a contract;

• Legitimate Interests: where processing is necessary for our legitimate interests or those of a third party, provided that such interests are not overridden by your interests or fundamental rights and freedoms;

• Legal Obligations: where processing is necessary for compliance with applicable legal or regulatory obligations; and

• Consent: where you have provided your consent to the processing of your personal data for one or more specific purposes.

3. Delegated processing, sharing, transfer, and public disclosure of personal information

3.1 Entrusted Processing

We may authorize and delegate authorized partners (such as website service providers, operation and maintenance technical service providers, advertisers and their agents, etc.) to process your personal information so that authorized partners can provide certain services or perform functions on our behalf for you. We will only entrust authorized partners to process your information for the legal, legitimate, necessary, specific, and explicit purposes stated in this Privacy Policy, on the premise of adopting industry-standard security technologies (such as not delivering your personal identity information to authorized partners in plain text). Authorized partners will only have access to the information necessary for them to perform their duties, and we will require them through agreements not to use this information for any purpose beyond the scope of the delegation. If an authorized partner uses your information for a purpose not delegated by us, it will separately obtain your consent.

3.2 Share

We may share your information with any member or affiliate of our group, which includes our subsidiaries, our ultimate holding company and its subsidiaries, and companies that we control, are controlled by or under common control, and our strategic business partners, and their subsidiaries, in each case in or outside your jurisdiction, for the purpose set out above.

We may also share your information with law enforcement agencies, public or tax authorities, or other organizations if legally required to do so, or if we determine that for purposes of national security, law enforcement, or other issues of public importance, disclosure is necessary or appropriate.

Currently, we will not proactively share your personal information with third parties other than above. In the event of other situations where your personal information is shared or you require us to share or transfer your personal information to a third party, we will obtain your explicit consent.

3.3 Transfer

As our business continues to develop, we may engage in transactions such as mergers, acquisitions, and asset transfers. We will inform you of the relevant circumstances and continue to protect or require the new controller to continue protecting your personal information in accordance with laws and regulations and at a standard no lower than that required by this Privacy Policy.

3.4 Public disclosure

We will not publicly disclose the collected personal information. If public disclosure is necessary, we will inform you of the purpose of this public disclosure, the types of information to be disclosed, and any potentially sensitive information involved, and obtain your express consent where required by applicable law.

3.5 Data Sale and Sharing

For users in California, we do not sell (for consideration) or share (cross‑context behavioral advertising) your personal information. We will set up a dedicated link “Do Not Sell or Share My Personal Information” in the website footer for California users to exercise their opt-out right with one click.

4.Information Storage

4.1 Methods and duration of information storage

We will store your information in a secure manner, including local storage, databases, and server logs.

We will keep your information while you have an account with us or while we are providing products or services to you or performing under a contract with you, or in accordance with any applicable requirement set forth in this policy. Under normal circumstances, except where mandatory retention periods are otherwise required by applicable laws and regulations, we will only store your personal information for the shortest period necessary to achieve the purpose of the service for which it was collected including as described in this Privacy Policy. Thereafter, we will keep your information for as long as is necessary to respond to any questions, complaints or claims made by you or on your behalf.

4.2 Geographical location of information storage

Personal information collected may be stored and processed in countries other than your location. We will protect your information in compliance with local data protection laws and requirements applicable in the storage jurisdiction. While data protection laws and standards vary across jurisdictions, and certain countries or regions may not provide a level of data protection equivalent to that of your home jurisdiction, we will apply the protections described in this Privacy Policy to your personal information regardless of where it is processed. We implement appropriate safeguards intended to comply with the requirements of applicable data protection laws.

For users in the EU/EEA, we rely on the following lawful mechanisms when transferring your personal data outside the EU/EEA:

• Article 49. We rely on Article 49 (1)(b) of the GDPR to transfer information as described in “Information We Collect and Use” to controllers in countries without an adequacy decision when necessary to provide products and services;

• Standard Contractual Clauses (SCCs): According to Article 46 of the GDPR, we use SCCs approved by the European Commission. Where necessary, we implement additional technical and organizational measures to ensure your personal data remains protected to an equivalent standard.

If you would like further information about the transfer mechanisms we rely on, or wish to obtain a copy of the relevant safeguards (including applicable SCCs), please contact our Data Protection Officer via [compliance@engineai.com.cn].

4.3 Notification when a product or service ceases operation

When our products or services cease operation, we will notify you in the form of push notifications, announcements, etc., and delete your personal information or conduct anonymization within a reasonable period, except as otherwise provided by laws and regulations.

5.Information Security

We use various security technologies and procedures to prevent the loss, improper use, unauthorized access, or disclosure of information. For example, in certain services, we will utilize encryption technologies (such as SSL) to protect the personal information you provide. However, please understand that due to technological limitations and various potential malicious means, in the internet industry, even if we do our best to strengthen security measures, it is impossible to always ensure 100% security of information. You need to be aware that the systems and communication networks you use to access our services may encounter problems due to factors beyond our control. In the event of a personal data breach that may endanger your rights, we will notify the regulatory authority within 72 hours after becoming aware of the breach as required by GDPR; high-risk breaches will be directly notified to you without undue delay. As required by CCPA, we maintain reasonable security procedures and practices appropriate to protect data.

6.Your rights

6.1 General Rights

During your use of our services, you enjoy the following rights as a personal information subject:

6.1.1 Right to be Informed, Access, Copy, and Correct

You have the right to be informed, to request access to, and obtain a copy of any personal information that we hold about you. You also have the right to request us to correct inaccurate or incomplete personal information.

6.1.2 Right to Withdraw Consent

Where we rely on your consent to process personal information, you may withdraw your consent at any time. Your decision to withdraw your consent shall not affect the lawfulness of our previous processing activities based on your consent.

6.1.3 Right to Refuse or Restrict Processing

You have the right to refuse or restrict our processing of your personal information under specific circumstances.

6.1.4 Responding to Your Request

If you need to exercise your rights, or if you believe that we have violated any laws and regulations or any agreements with you regarding the collection or use of personal information, you may contact us through the contact information disclosed in the "Contact Us" section of this Privacy Policy. To ensure security, we may require you to provide a written request or your identification documents, and we will respond to your request typically within 30 days (for GDPR users) or 45 days (for CCPA users) (subject to extensions where permitted by law) after receiving your feedback and verifying your identity.

We generally do not charge for your reasonable requests, but for requests that are repeatedly made, exceed reasonable limits, we will charge a certain cost based on the circumstances. For requests that are made without cause, require excessive technical means (e.g., developing a new system or fundamentally changing current practices), pose risks to the legitimate rights and interests of others, or are highly unrealistic (e.g., involving information stored on backup tapes), we may decline them.

6.2 Rights of EU/EEA Users (GDPR Additional Rights)

6.2.1 Right to Erasure

You have the right to request that we erase your personal information where:

• The personal information is no longer necessary for the purpose(s) for which it was collected or otherwise processed;

• You withdrew your consent on which the processing is based, and there is no other legal basis for the processing;

• You object to the processing of your personal information, and we do not have overriding legitimate grounds to continue processing it;

• Your personal information has been processed unlawfully;

• Other circumstances provided for by GDPR or applicable laws in the EU/EEA .

6.2.2 Right to Data Portability

You have the right to receive your personal information in a commonly used, machine-readable structured format, where technically feasible, or request that such data be directly transferred to another data controller you specified.

6.2.3 Right to Object

You may object to our processing of your personal information for public interest or legitimate interest purposes based on your own special reasons; for processing for direct marketing purposes, you may object at any time without conditions.

6.2.4 Right to Refuse Automated Decision-Making (including Profiling)

We do not currently carry out automated decision-making. If we carry out automated decision-making in the future, you have the right not to be bound by decisions that have a significant impact on you and are made solely based on automated processing (including user profiling), and you may request human intervention.

6.2.5 Right to Lodge a Complaint

If you believe our processing of your personal information violates applicable data protection laws, you have the right to lodge a complaint with a supervisory authority.

• You can find the contact details for all EEA data protection authorities at https://edpb.europa.eu/about-edpb/board/members_en.

• For the UK, please visit https://ico.org.uk/global/contact-us/.

• For Switzerland, please visit https://www.edoeb.admin.ch/edoeb/en/home/deredoeb/kontakt.html.

6.3 Rights of California Users (CCPA/CPRA Additional Rights)

Subject to applicable exceptions, you may exercise the following rights:

6.3.1 Right to Know

• You have the right to request information regarding:

• The categories of personal information we have collected about you;

• The categories of sources from which the personal information was collected;

• The business or commercial purposes for collecting, selling, or sharing personal information;

• The categories of third parties to whom we disclose personal information; and

• The specific pieces of personal information we have collected about you.

6.3.2 Right to Delete

You have the right to request that we delete personal information that we have collected from you.

6.3.3 Right to Opt Out of Data Sale/Sharing

You have the right to opt out of our sale or sharing of your personal information (including disclosure to third parties for commercial purposes) at any time, and we will provide you with a simple and permanently effective opt-out channel.

6.3.4 Right to Restrict Use of Sensitive Personal Information

You have the right to request us to restrict or cease the use and disclosure of your sensitive personal information.

6.3.5 Non-discrimination in exercising rights

When you exercise any privacy rights under this Policy, we shall not impose differential treatment on you (including refusing to provide services, reducing service quality, increasing prices, etc.).

7. Change

We may revise the terms of this Privacy Policy from time to time. When changes occur, we will notify you of the new Privacy Policy through appropriate means before such changes take effect and inform you of the effective date.

8. Minors Protection

Our services are not intended for minors. We do not proactively collect personal information of minors, and we will not sell or share such information to third parties. If you believe that we have inadvertently collected personal information from a minor under the age threshold applicable under the laws of their jurisdiction without a valid legal basis, please contact us through the contact information disclosed in the Privacy Policy so that we can delete such information as soon as possible.

9. Contact Us

This service is provided by EngineAI Robotics Technology Co., Ltd.

We have established a dedicated personal information protection team and a personal information protection officer. If you have any questions, comments, suggestions regarding personal information protection issues or the content of this Privacy Policy, or if you wish to file a complaint, report, etc., you may contact us via [compliance@engineai.com.cn].

For EU/EEA users, according to Article 27 of the GDPR, EngineAI has designated the following representatives within the European Union for the contact of the EU data protection authorities and data subjects:

Contact Email: [compliance@engineai.com.cn]