1. Controller & Data Protection Contact
The operator of Cerawend (“we,” “us,” or “our”) is Xiangxiang Ci Li Trading Co., Ltd. We determine why and how personal data is processed in connection with the mobile experience branded Cerawend on Google Play and therefore act as the data controller for such processing where privacy law assigns that role to us.
Privacy & data requests: inquiry@xxcilitrading.com
Alternate inbox: eunicerodr95@gmail.com
Website: https://xxcilitrading.com
Use inquiry@xxcilitrading.com for privacy questions, data subject requests, and coordination with authorities. We designate this channel as our Data Protection Contact (sometimes labeled privacy officer or data protection officer function depending on jurisdiction).
2. What Cerawend Is
Cerawend is a lifestyle and light community companion centered on handmade ceramics, table moments, and quiet hosting scenes. The experience blends a curated starter collection of inspiration cards, a feed you can filter by mood, tools to assemble styling “boards,” saved favorites, optional publishing flows that combine photos with studio-style annotations, and consumable coin purchases for premium exports or previews depending on the build you install.
Unless a feature explicitly states otherwise, most editing and preview work occurs on your Android device. We do not require email-based registration to appreciate the editorial layer; certain interactions (for example, purchases or optional cloud-backed features we may introduce later) can create records with Google or with us as described herein.
3. Information We Process
3.1 Content & Creative Inputs
When you capture or import photos, record short voice notes, draft Wheel Notes, assemble Setline boards, publish Studio Capture sequences, or compose posts that may be encoded into short motion or video exports on-device, those materials reside primarily in local storage until you export or transmit them. If you use sharing surfaces that invoke other apps, those destinations process your content under their own policies.
3.2 Product Telemetry & Diagnostics
We may log app version, device model, OS level, language, crash signatures, performance counters, and coarse usage events needed to operate a stable experience on fragmented Android hardware.
3.3 Purchases & Coins
Google Play Billing processes payments. We may sync SKU identifiers, transaction receipts, coin balances, and anti-abuse signals permitted by the store.
3.4 Support & Feedback Correspondence
If you email or in-app message us (including enriched feedback that attaches audio), we retain message bodies, technical attachments, and contact details you supply.
3.5 Identifiers for Advertising & Analytics
Depending on SDK configuration, your device’s advertising ID or similar tokens may be read by analytics or monetization partners. You may reset or limit such identifiers through Android settings where available.
4. Permissions & On-Device Access
Cerawend requests runtime permissions in context. Declined permissions generally limit specific features rather than the entire app. Supplementary notices appear in English inside the client where required.
4.1 Camera
Use: Photographing pottery works, studio details, or table scenes for posts, Setline captures, Studio Capture flows, or publishing paths that may assemble frames into on-device video-style exports.
Alternatives: You may import existing photos if you prefer not to grant camera access.
4.2 Photo Library (Read)
Use: Selecting images from your gallery when composing posts, boards, or Kiln-to-Table cards.
Scope: Modern Android pickers generally expose only items you explicitly choose.
4.3 Photo Library / Media (Write)
Use: Saving rendered Kiln-to-Table cards, exported boards, or other shareable images into your gallery or scoped media locations the system designates for the app.
4.4 Microphone
Use: (a) Capturing voice notes associated with Wheel Notes or similar creative journaling features; (b) Attaching spoken feedback through the Profile feedback surface when you choose to send audio alongside written remarks. Microphone access is optional and only active when you start those flows.
4.5 Storage & App-Specific Files
Android may grant access to app-specific directories or, where legacy APIs remain, broader storage scoped to your approvals. We use these surfaces to cache drafts, exports, and downloaded inspiration assets.
4.6 Application & Package Metadata
The operating system provides package name, signing certificate data, version codes, and attestations (for example, Play Integrity) so updates and purchases remain trustworthy.
5. Community Posts, Boards & Studio Workflows
Features such as Feed filters, Saved libraries, Not My Glaze controls, and reporting queues can process interactivity metadata (for example, which moods you prefer, saved item IDs, or abuse flags). If we introduce server-side hosting for user posts, we will update this Policy and the in-product disclosures before collecting networked personal data beyond what is already described.
You should avoid uploading sensitive personal data of third parties without lawful justification; you warrant you have authority over the media you publish, as expanded in the Terms of Use.
6. Purposes of Processing
- Operate storytelling, mood filters, board composition, saving, and export experiences.
- Route monetary packs, virtual coins, and entitlement checks through Google Play.
- Maintain trust & safety, including report triage references to Child Safety Standards.
- Monitor reliability, prioritize bug fixes, and plan API migrations mandated by Android releases.
- Respond to lawful requests, tax obligations, and contractual commitments owed to distribution partners.
- Fulfill communications you initiate (support, privacy requests, safety escalations).
7. Legal Bases (EEA, UK, CH & Similar)
Where the GDPR, UK GDPR, Swiss FADP, and aligned regimes apply, we rely on:
- Performance of a contract (Art. 6(1)(b) GDPR): delivering features and purchases you request.
- Legitimate interests (Art. 6(1)(f) GDPR): securing the service against abuse, improving stability, understanding aggregated usage, and documenting transactions—balanced against your rights.
- Consent (Art. 6(1)(a) GDPR): optional analytics, marketing emails if ever offered, or sensitive processing where national law demands opt-in consent.
- Legal obligation (Art. 6(1)(c) GDPR): retaining invoices or responding to competent authorities.
Under Brazil’s LGPD, comparable headings include execution of services, legitimate interest, consent, fraud prevention, and legal compliance, evaluated per activity.
8. Retention
Device-bound creative files remain until you delete them or clear app storage. Uninstalling Cerawend typically erases sandboxed data unless the OS retains backups you manage separately.
Purchase histories may persist for statutory accounting periods through Google’s ledgers (often multi-year horizons).
Support tickets & safety reports are generally kept up to twenty-four months after closure unless litigation or investigation requires longer retention.
Aggregated statistics lacking personal identifiers may be stored indefinitely.
10. U.S. “Sale,” “Sharing,” Right to Know & Opt-Out (CCPA/CPRA & Other States)
Laws such as the CCPA, the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), Utah, and other state statutes use defined terms that can differ from everyday English. Under California law in particular, “sell” or “sale” can include disclosing or making available personal information to a third party for monetary or other valuable consideration, not only cash sales. “Share” or “sharing” has a specific meaning and includes disclosing personal information for cross-context behavioral advertising when that concept applies under the CCPA and its regulations.
We do not operate a list brokerage for cash. Depending on SDK and partner configuration, certain transfers of identifiers or usage events could nonetheless fall within statutory definitions of sale or sharing. The rights and contact methods below apply regardless, so you can learn how to exercise your choices.
10.1 Your right to know whether personal information is sold
California residents and consumers covered by similar state laws: You have the right to know whether we sell your personal information, using “sell” and related terms as defined under the CCPA/CPRA (and analogous constructs where other states use comparable language). You may submit a verifiable consumer request to obtain that information together with the disclosures those laws require for applicable look-back periods (which may include categories of personal information sold, categories of third parties, and related details).
10.2 Your right to know whether personal information is shared
California residents: You have the right to know whether we share your personal information, including whether we share personal information for cross-context behavioral advertising, in each case as “share” and related terms are defined under the CCPA/CPRA. You may submit a verifiable consumer request to obtain confirming information and the supplemental disclosures required by law.
10.3 Your right to opt out of the sale of personal information
California residents and consumers covered by applicable state laws: You have the right to opt out of the “sale” of personal information when such activity is occurring and we have flexibility to honor the request under law. You also have comparable opt-out rights under certain other state frameworks (for example, Colorado and Connecticut provisions addressing sales and targeted advertising in their respective statutes).
10.4 Your right to opt out of sharing for cross-context behavioral advertising
Where the CCPA’s concept of sharing applies, California residents have the right to opt out of the sharing of personal information for cross-context behavioral advertising, subject to verification and statutory exceptions.
10.5 Do Not Sell or Share My Personal Information — how to exercise your choices
To exercise any of the rights in Sections 10.1 through 10.4, or to request related disclosures for the statutory period, email inquiry@xxcilitrading.com from an address you monitor. Use one of these subject lines so we can route your message promptly:
- “Cerawend — Right to Know (Sale)” — to ask whether personal information has been sold and for required details.
- “Cerawend — Right to Know (Share)” — to ask whether personal information has been shared (including for cross-context behavioral advertising where applicable) and for required details.
- “Privacy Opt-Out — Cerawend” or “Cerawend — Do Not Sell or Share My Personal Information” — to opt out of sales and/or sharing for cross-context behavioral advertising that we control.
Include a short description of your device or interaction (for example, app version, region, and approximate dates of purchases or support emails) so we can verify your request when the law requires it. We may request additional information to confirm identity or authorized-agent status. You may also use Android advertising identifier controls and Google Play privacy settings to limit certain disclosures at the device or platform layer.
Where your browser or device transmits an opt-out preference signal recognized under the CCPA (or similar), we will process that signal to the extent legally required once technically feasible for our properties we control.
We will not discriminate against you for exercising privacy rights, except where a loyalty, discount, or feature variation is expressly permitted by applicable statute and the program terms are presented in compliance with law.
11. International Transfers
Our business address sits outside the European Economic Area, United Kingdom, and Switzerland. If you access Cerawend from those regions, transfers may occur to facilities or subprocessors globally. Where regulators require supplementary measures, we implement instruments such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or Swiss adaptations, plus supplementary technical measures upon request.
12. Security
We apply administrative, technical, and organizational controls calibrated to the sensitivity of processed data, including access minimization for staff, encryption in transit for networked APIs we operate, and reliance on Android sandboxing for on-device assets. No system is perfectly secure; please protect device passcodes and keep OS patches current.
13. Regional Privacy Rights
You may enjoy rights to access, rectify, erase, restrict, export, or object to certain processing, to withdraw consent without undermining earlier lawful processing, and to decline automated profiling with legal effect where such profiling exists. Brazilian residents may petition ANPD; EEA, UK, and Swiss residents may involve supervisory authorities listed in Section 14.
Submit requests through inquiry@xxcilitrading.com. We respond within statutory windows or, absent a deadline, within forty-five days with possible extensions for complex cases. Authorized agents may act on your behalf when recognized by law; include signed authorization where applicable.
13.1 GDPR / UK GDPR / FADP Highlights
You may lodge complaints where you live, work, or observe a breach. You may also seek judicial remedy alongside administrative routes.
13.2 U.S. State Privacy Laws (including CCPA/CPRA, VCDPA, CPA, CTDPA)
In addition to the right to know whether personal information is sold or shared and the right to opt out of sale and sharing described in Section 10, residents covered by the CCPA and certain other state laws may have rights to know the categories and specific pieces of personal information collected; delete personal information subject to exceptions; correct inaccurate information; limit certain uses of sensitive personal information where provided; obtain a copy of personal information in a portable format where required; and appeal a denied request where an appeals process is mandated (including Virginia and Colorado). Colorado, Connecticut, and other states may impose additional duties on controllers that align with these themes.
Submit all U.S. state privacy requests to inquiry@xxcilitrading.com. We will respond within the timeframes those laws prescribe or notify you of any lawful extension.
13.3 LGPD
You may confirm processing, access, correct, anonymize, block excessive data, revoke consent, and receive information about sharing with public or private entities.
13.4 South Korea (PIPA)
If you are in the Republic of Korea, the Personal Information Protection Act (PIPA) and related rules may grant you rights regarding notice, access, correction, deletion, and suspension of processing in defined circumstances, and the right to lodge complaints with the competent authority. Contact inquiry@xxcilitrading.com to exercise applicable rights; we will respond consistent with Korean law where it applies to our processing.
14. Regulatory Complaints
You are entitled to contact data protection regulators without first exhausting conversations with us, although we welcome the opportunity to resolve issues directly. Examples include:
- EEA: your national supervisory authority (European Data Protection Board publishes a directory).
- United Kingdom: Information Commissioner’s Office (ICO).
- Switzerland: Federal Data Protection and Information Commissioner (FDPIC).
- Brazil: Autoridade Nacional de Proteção de Dados.
- United States: state attorneys general or dedicated privacy units where available.
15. No Use by Children
Cerawend targets adults. We do not knowingly collect personal information from anyone under eighteen (18). Guardians who believe a minor submitted data should alert us promptly; we will delete information not legally required to retain.
16. Third-Party Services
Embedded browsers, share sheets, or partner SDKs remain governed by their respective policies. Google Play’s privacy terms apply to billing and distribution infrastructure: https://policies.google.com/privacy.
17. Changes & Annual Review
We may revise this Policy to track new product surfaces, regulatory obligations, or clarity edits. Material updates will be reflected through revised effective dates, in-app alerts where feasible, and distribution notes on Google Play. Continued use after notice where permitted signifies acceptance except where explicit consent is mandated.
We treat an annual review of this Privacy Policy as a standing compliance practice and, where statutes such as the CCPA require or strongly expect an up-to-date notice of our practices, we update the “Last reviewed & updated” date in the header and revise the body so it continues to describe how we collect, use, disclose, “sell,” and “share” personal information (using those terms as defined in applicable law) and how you can exercise your rights.