Privacy Policy

This policy explains what personal data IsItAFactory collects, why we collect it, who else processes it, and what you can ask us to do with it. It describes what this website actually does; there are no analytics, advertising or tracking services on it.

1. Who we are

IsItAFactory is an independent research service operated by an individual based in mainland China. We prepare written reports that summarise information taken from official Chinese public records. For the purposes of the EU and UK General Data Protection Regulation, that individual is the data controller.

You can reach us at our contact form or by replying to any email we have sent you.

2. What we collect

We collect only what we need to produce a report, get it to you and answer your questions.

When you place an order

• your email address, so we can deliver the report and send order updates;
• the name of the Chinese company you want checked, plus any registration number (USCC) or website or shop link you give us;
• the package and any optional add-ons you selected, and the total price;
• whatever you write in the free-text field describing your concern;
• your preferred report language, and the site language you were using;
• the order number, its status and timestamps;
• payment status, the method used, PayPal order and capture identifiers, the amount paid, and the email address on the PayPal account.

When you use the contact form

• your name (optional), your email address, the company you are asking about (optional), and the text of your message.

When you subscribe to our emails

• your email address, the site language you were using, and where on the site you subscribed;
• whether and when you confirmed the subscription and, if applicable, when you unsubscribed.

Placing an order also creates a record in our mailing list, so that we can send you a follow-up about the report we delivered and so that we can honour an unsubscribe request.

What we do not collect

We do not run analytics, advertising, heat-mapping or session-recording scripts. We do not ask for your card number or bank details: card data is entered on PayPal's own site and never reaches our servers. We do not ask for identity documents.

3. IP addresses

We look at the IP address of requests to the order form, the contact form, the subscribe form and the order-tracking page for one purpose only: rate limiting, to stop automated abuse of forms that send email. Those IP addresses are held in the server's memory for at most one hour and are not written to our database.

Our application log records IP addresses only in truncated form (for example 203.0.113.x.x), which is enough to see that a network range is misbehaving but not enough to identify an individual. Our web server keeps standard access logs for security and troubleshooting; those contain full IP addresses and are rotated by the hosting configuration.

4. Why we use your data

• To perform our contract with you — producing and delivering the report you ordered, taking payment, and handling questions about that order.
• Our legitimate interests — preventing abuse of our forms, keeping the records we need for accounting and tax purposes, and sending one follow-up about a report we have already delivered to you.
• Your consent — sending you our newsletter. You may withdraw that consent at any time.

Every newsletter and follow-up email contains a one-click unsubscribe link that works without logging in. We do not make automated decisions about you and we do not build profiles.

5. Who else processes your data

We use a small number of service providers, each of which processes data only on our instructions:

• PayPal — payment processing. PayPal collects and controls its own data; see PayPal's privacy statement for what it holds.
• Resend — delivery of our transactional email: order confirmations, status updates, replies to your message, and newsletters. Your email address and the content of the message pass through them.
• Cloudflare — DNS, content delivery and email routing for our domain. Like any content delivery network, it sees the IP addresses of visitors.
• Our hosting provider — operates the virtual server on which this site and its database run.

Some of these providers are located outside your country, including in the United States. Where a transfer requires a safeguard, it relies on the provider's standard contractual clauses or an equivalent mechanism.

We do not sell, rent or trade your personal data. We do not share it with anyone else except where the law requires it, or where it is necessary to establish, exercise or defend a legal claim.

6. Data about the company you ask us to check

A report is built from official public registers. It does not contain personal data that is not already public in those registers. We do not publish reports, and we do not tell the company you asked about that you asked. The report is delivered to you alone.

7. How long we keep it

• Order records, including your email address and the company you asked about: three years after delivery, so that we can answer questions about the report and meet accounting and tax obligations.
• Contact form messages: twelve months.
• Newsletter subscriptions: until you unsubscribe. After that we keep your address only in a suppression list, so that we do not email you again by mistake.
• Rate-limiting IP addresses: at most one hour, in memory only.

8. Cookies

We set one cookie. It is strictly necessary for the site to function: a session cookie that protects our forms against cross-site request forgery and remembers which orders this browser has just placed, so that the order-tracking page does not ask you for your email address again.

It contains no advertising or analytics identifier. Because we use no tracking or advertising cookies, this site shows no cookie banner.

9. Your rights

Depending on where you live, you may have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• ask us to delete your data, where we are not obliged to keep it;
• ask us to restrict how we use it, or object to our use of it;
• receive your data in a portable format;
• withdraw consent for newsletter email at any time;
• complain to your national data protection authority.

To exercise any of these, write to us through the contact form. We answer within 30 days. We may ask you to confirm that you control the email address in question before we act.

One limitation worth stating plainly: a report is a record of what official registers said at a particular moment, and it is evidence that a transaction happened. If you ask us to delete your personal data we will do so, but we may have to keep the fact that a report was produced in order to satisfy accounting requirements.

10. Security

Traffic to this site is encrypted with HTTPS. Access to the order database requires credentials held only by the operator. Payment credentials are never stored on our servers. No system is perfectly secure, so we cannot promise absolute security; we limit what we collect in order to limit the consequences if something does go wrong.

11. Children

This is a business research service and is not directed at children. We do not knowingly collect data from anyone under 18.

12. Changes to this policy

If we change this policy we will update the date at the top of the page. If a change materially affects how we use your data, we will also note it on the site.