1. Scope of this Policy

Except for specific products or services that have a separate privacy policy, this Privacy Policy applies to all Fangcun AI online pages, platforms and services that refer or link to it. It explains how we collect, use, disclose, process and protect personal information that you authorize us to receive or that we collect when providing products or services on our website and through the applications we offer.

If a product or service has a separate privacy policy, that policy takes precedence. This Privacy Policy applies to matters not covered by that product's or service's separate policy. How a particular product or service collects and processes your personal information may also vary depending on factors such as your operating system, service version or location. Please refer to the separate privacy policy for details.

2. Information we collect and how we use it

To provide our website, products and services, we process the personal information necessary for the features you actually choose to use. We collect and use information only for specific, explicit and lawful purposes. Listing a category of information in this Policy does not mean we collect it in every situation. You may choose not to provide information that is not necessary for a particular feature; however, this may prevent us from fulfilling your request or providing that feature.

1. Information we collect

1.1 Information you provide to us

Depending on the features you use or how you interact with us, you may provide the following information:

• Contact and business information. When you make a business inquiry, request a demo or otherwise communicate with us, you may provide your name, work email address, telephone number, organization, job title, inquiry and correspondence. We use this information to respond to your requests, arrange demos, provide pre-sales support, or establish and carry out business relationships.
• Account and transaction information. When you register for or use an online service, you may provide your email address, company name, account identifier and verification information. When you purchase a paid service, you may provide order and invoicing information. We may also receive an order number, amount and payment status from the payment service provider. Complete payment account information is generally processed by the payment service provider under its own rules.
• Content you submit or authorize us to process. When you use detection, evaluation, security protection or other product features, you may submit text, files, tools, project materials or other content. We process this content, along with related inputs, outputs and analysis results, to the extent necessary to provide the relevant features.
• Technical support and fault feedback information. When you request technical support, submit feedback or enable the upload of fault information, you may provide contact details, a description of the issue, the time it occurred, device and operating system information, application status, error events, diagnostic logs, screenshots or attachments. We use this information to identify problems, provide support and maintain service stability.
• Recruitment information. When you apply for a position through our recruitment email address or other channels, you may provide your name, contact details, résumé, education and employment history, the position you are applying for and other application materials. We use this information to assess your suitability, arrange interviews and communicate with you.

1.2 Information generated when you use our website, products and services

When you visit our website or use an online service, our systems may automatically generate the following information:

• Website access and log information. This includes IP address, access time, browser and device type, operating system, pages visited, referring pages, identifiers generated by cookies or similar technologies, and network and security logs. We use this information to display and maintain the website, troubleshoot problems, prevent attacks and abuse, and fulfill cybersecurity obligations.
• Service usage and security information. This includes service usage times, IP address, endpoints or call paths, call status, usage volume, error records and security events. We use this information to provide and maintain services, verify identity and permissions, measure service usage, detect unusual activity and resolve technical issues.
• Enterprise operational security information. When an enterprise customer enables relevant product capabilities, our systems may process operational status, security events, audit records, and necessary system behavior and contextual information, depending on the deployment method, features and configuration chosen by the customer. This enables operational security monitoring, risk analysis, alerts, response and auditing. The specific scope of processing is subject to the customer's configuration, contractual terms and product-specific notices.

1.3 Information we obtain from third parties

Where permitted by law, we may obtain information about you from the following sources:

• Your company or organization, which may provide enterprise account, membership, permission configuration and service administration information;
• Payment service providers, which may return order numbers, amounts, payment status and refund status;
• Partners you have authorized, or other entities that may lawfully provide the relevant information.

We require information providers to explain the source of the personal information and confirm that they have an appropriate lawful basis. We use the information we receive only for the purposes described in this Policy and to the extent necessary.

2. How we use this information

We may use the information described above for the following purposes:

• To provide, deliver and maintain the website, products or services you choose and keep them operating properly;
• To create and manage accounts, authenticate users, verify permissions, meter services, settle payments and issue invoices;
• To respond to inquiries, arrange demos, provide customer support, and handle feedback, complaints and requests;
• To diagnose faults, fix errors, analyze security incidents, and prevent attacks, fraud, abuse and unauthorized access;
• To compile necessary de-identified or aggregated operational metrics for capacity management, stability analysis and troubleshooting;
• To fulfill contractual and legal obligations, and cooperate with competent authorities acting in accordance with the law;
• For other purposes that we explain separately to you and for which we obtain the necessary authorization as required by law.

We do not use content you submit or authorize us to process, or fault information you voluntarily submit, to train general-purpose models or detection models unless we expressly inform you separately and obtain the necessary authorization.

3. Product operational data and fault information

Some Fangcun AI products analyze the operational status and security events of AI systems or agents. The relevant data may be processed in the customer's local environment or in a designated environment, depending on the deployment method chosen by the customer and the contractual terms.

If the relevant data remains entirely in the customer's local environment and is not transmitted to us, we do not obtain that data. When a customer enables cloud features or remote support, or a user voluntarily submits fault information, diagnostic logs or other materials, we process the information received only within the scope of the relevant features, customer instructions and contractual terms.

Fault logs, screenshots, attachments or operational context may contain personal information, business data or third-party information. Before submitting them, please review the content and remove passwords, keys, access tokens and other sensitive information unrelated to troubleshooting.

When a standalone Observer application, client or cloud service is formally made available, we will provide a separate product privacy policy or specific notice based on its actual deployment methods, data scope and controls.

4. Grounds for processing personal information

Depending on the circumstances, we may process personal information on one or more of the following grounds:

1. We have obtained your consent;
2. Processing is necessary to enter into or perform a contract to which you are a party;
3. Processing is necessary to fulfill statutory responsibilities or obligations;
4. Processing is necessary to respond to a public health emergency or, in an emergency, to protect the life, health or property of individuals;
5. Processing, within a reasonable scope, personal information that you have made public or that has otherwise been lawfully made public;
6. Other circumstances provided for by laws or administrative regulations.

If there is a material change in the purpose or method of processing, or in the categories of personal information processed, we will provide a new notice as required by law. Where consent or separate consent is required, we will obtain it separately.

5. Sensitive personal information

We generally do not ask you through our website to provide sensitive personal information such as biometric data, medical and health information, financial account information, precise location history or information about specific identities. However, content, logs, screenshots, attachments or résumés you submit may contain sensitive personal information.

If a feature does require the processing of sensitive personal information, we will explain why it is necessary, the specific purpose and method of processing, and its impact on individual rights and interests. We will obtain separate consent or complete other necessary procedures as required by law. Please do not submit sensitive personal information unrelated to your purpose of use.

3. Cookies and similar technologies

We may use cookies, local storage or similar technologies to maintain website and account sessions, record necessary settings, protect security, troubleshoot problems, and understand the basic operation of our website and services.

Disabling strictly necessary cookies may prevent some website or service features from working properly. For non-essential statistics, analytics or marketing cookies, we will provide appropriate notice and choices to the extent required by applicable law. You can also manage or delete cookies through your browser settings.

If we use new third-party statistics, advertising or cross-site tracking tools in the future, we will update the relevant notices before enabling them and provide ways to refuse or withdraw as required by law.

4. Entrusted processing, provision, transfer and disclosure

1. Entrusted processing

To provide and maintain our website and services, we may entrust infrastructure, cloud computing, cybersecurity, email communications, technical support or payment service providers with processing necessary personal information. Our contracts specify the purpose, duration and method of processing, the categories of information, safeguards, and each party's responsibilities. We also supervise the entrusted parties' processing activities.

Based on the services currently offered through our website, the main third parties that may be involved include:

When we integrate a new third-party service that processes personal information, we will update this Policy, our list of information shared with third parties, or the relevant product page.

2. Provision to other personal information handlers

We do not sell your personal information. We do not provide it to other personal information handlers except in the following circumstances:

1. We have informed you of the recipient, the purpose and method of processing, and the categories of personal information, and have obtained your separate consent as required by law;
2. Provision is required by laws and regulations, for litigation or dispute resolution, or by a lawful request from administrative or judicial authorities;
3. Provision is reasonably necessary to protect your, our or another person's life, health, property or other significant lawful rights and interests;
4. Information is transferred to a recipient in accordance with the law in connection with a merger, division, restructuring, asset transfer, dissolution, bankruptcy or similar transaction. We will inform you of the recipient's details and require the recipient to continue to comply with this Policy and applicable law. If the recipient changes the purpose or method of processing, it must complete the required legal procedures again.

3. Public disclosure

As a general rule, we do not publicly disclose your personal information. Where disclosure is necessary, we will inform you of its purpose and the categories of information involved and obtain separate consent as required by law, unless laws or regulations provide otherwise.

5. Enterprise customers and organizational accounts

If you use our enterprise products through an account, device or environment provided by your organization, its administrators may access or manage accounts, configurations, operational records and audit information within their administrative permissions. Enterprise customers are responsible for determining lawful processing purposes and scope, notifying the individuals concerned, obtaining necessary authorization, and setting appropriate permissions and retention periods in accordance with the law.

When an enterprise customer entrusts us with processing personal information, we process it in accordance with the customer's lawful instructions and our contract, without independently changing the purpose or method of processing. For this data, you can generally first submit rights requests to your organization or the relevant enterprise customer. We will assist the enterprise customer in handling such requests as required by our contract and the law.

6. Storage locations and retention periods

We retain personal information for the shortest period necessary to achieve the processing purpose. When the retention period expires or the information is no longer needed for that purpose, we delete or anonymize it in accordance with the law. If laws or regulations require continued retention, or deletion is technically difficult, we stop all processing other than storage and necessary security measures.

We generally determine retention periods using the following criteria:

As a general rule, we store personal information collected and generated through our operations in the People's Republic of China within the People's Republic of China. If it is necessary to provide personal information outside China, we will inform you of the overseas recipient, the purpose and method of processing, the categories of information and how to exercise your rights; obtain separate consent; and complete a data export security assessment, personal information protection certification, standard contract or other applicable procedures as required by law.

7. How we protect personal information

We take reasonable technical and organizational measures appropriate to the types of personal information, processing circumstances and risks. These include access controls, authentication, encryption or de-identification, security audits, backups, permission management, personnel training and incident response, to prevent unauthorized access and the disclosure, alteration, loss or misuse of personal information.

Absolute security cannot be guaranteed on the internet. If personal information is or may be disclosed, altered or lost, we will take remedial measures in accordance with the law. Where required by law, we will report the incident to the relevant authorities and notify affected individuals of the incident, its possible impact, and measures taken or recommended.

8. Your personal information rights

To the extent provided by applicable law, you have the right to be informed about and make decisions concerning the processing of your personal information, and to restrict or refuse processing. You may also request to:

1. Access and obtain a copy of your personal information;
2. Correct or supplement inaccurate or incomplete personal information;
3. Delete personal information where the relevant conditions are met;
4. Withdraw authorization based on consent;
5. Close your account or stop the relevant services;
6. Transfer personal information where the statutory conditions are met;
7. Ask us to explain our personal information processing rules;
8. Submit complaints or suggestions regarding our processing activities.

You can submit a request through the email address listed in the “Contact us” section of this Policy. To protect your personal information, we may ask for the information necessary to verify your identity. Once your identity is verified, we will handle your request promptly in accordance with the law. If we cannot fulfill your request, we will explain why. We may lawfully limit or refuse requests that are unreasonably repetitive, exceed a reasonable scope, require excessive technical effort, may harm others' lawful rights and interests, or do not require a response under the law.

Unless a deceased person made other arrangements during their lifetime, their close relatives may, for their own lawful and legitimate interests, exercise rights such as access, copying, correction and deletion regarding the deceased person's relevant personal information, in accordance with the law.

Withdrawing consent does not affect processing already carried out on the basis of that consent before its withdrawal. For information necessary to perform a contract, fulfill legal obligations or maintain security, withdrawing consent may not prevent us from continuing necessary processing on another lawful basis.

9. Marketing and automated decision-making

If we send you information about products, services or events, we will obtain the necessary authorization to the extent required by applicable law and provide a convenient way to unsubscribe or opt out.

We do not currently make decisions that significantly affect individuals' rights and interests solely through automated decision-making. If we undertake such processing in the future, we will ensure transparency, fairness and impartiality as required by law and provide explanations, the right to refuse decisions made solely through automated decision-making, or other applicable safeguards for your rights.

10. Personal information of minors

Our website and enterprise products are primarily intended for businesses, professionals and developers, and are not specifically directed at minors under 14. We do not knowingly solicit personal information from minors under 14.

If a product or service does need to process the personal information of minors under 14, we will establish specific personal information processing rules and obtain the consent of their parents or other guardians as required by law. If you discover that a minor has provided personal information to us without a guardian's consent, please contact us promptly. We will verify and address the matter in accordance with the law.

11. Updates to this Policy

We may update this Policy to reflect business changes, product adjustments or legal and regulatory requirements. The updated Policy will be published prominently on our website and will show its last updated date.

If a change may significantly affect your personal information rights and interests, we will provide prominent notice through website prompts, in-service notifications, email or other appropriate means. For new processing activities that require consent by law, we will complete the applicable procedures separately rather than treating your continued use of the services as consent.

12. Contact us

Personal information handler

Fangcun AI (Xiong'an) Technology Co., Ltd. (方寸跃迁（雄安）科技有限公司)

Registered address

F2-023, Unit 4, North Zone of Chuangzhi Park (Artificial Intelligence Industrial Park), No. 164 Yining Avenue, Start-up Area, Xiong'an Area, China (Hebei) Pilot Free Trade Zone

Email

info@fangcunleap.com

Official website

https://fangcunleap.com/

If you have any questions, comments, complaints or suggestions about this Policy, our personal information processing activities or rights requests, please contact us at the email address above. We will verify the relevant circumstances and handle the matter promptly in accordance with the law.

1. Purpose

Frontier AI is becoming more capable at a rapid pace. Whether these systems are safe is a question the public, policymakers, and the industry all need answered credibly. Fangcun AI aims to contribute as an independent third party, providing objective and reliable safety evaluations that help developers identify and address problems, and that give the public and policymakers a sound basis for their decisions.

Independence is what allows a third-party evaluation to earn trust. Rigorous methods lead to credible conclusions only when others can be confident that those conclusions are not influenced by funding, equity, or personal relationships. This policy therefore sets clear boundaries on funding, paid work, equity, and personal relationships, and commits us to full disclosure in every published report.

This policy is designed to meet condition 2.3 of AEF-1, the AI Evaluator Forum's minimum operating conditions for independent third-party AI evaluations. It also supports conditions 2.1 (no contingent compensation), 2.2 (no organizational control), 2.4 (conflict-of-interest disclosure), and 2.5 (recusal). AEF-1 as used in this policy means Version 1, updated 4 December 2025.

2. Scope

This policy applies to every evaluation we conduct of a named frontier AI company's systems, and to everyone who takes part in one, including employees, interns, contractors, advisors, and members of the board of directors.

The following are outside its scope: research on general evaluation methods, reports that do not assess a specific company, and evaluations of AI applications built by companies in other industries.

3. Definitions

• Frontier AI company: a company whose best model ranks among the top ten on the Artificial Analysis Intelligence Index at any time during an evaluation period. Companies whose models are tied for tenth place are all included. If the Index is unavailable or its methodology changes materially, the evaluation committee determines which companies qualify as frontier AI companies for that period and records its reasons.
• Evaluated company: the frontier AI company whose system is the subject of an evaluation.
• Direct competitor: any frontier AI company other than the evaluated company.
• Personnel: everyone covered by this policy under Section 2.
• Immediate family: a spouse or partner, and dependent children.
• Paid evaluation: an evaluation of a frontier AI company's model for which Fangcun AI receives payment from that company.

4. Organizational Commitments

1. Editorial independence. We alone decide what we evaluate, how we evaluate it, and what we publish. We accept no funding, paid work, or other support that comes with control over these decisions.
2. Paid evaluations. Where costs allow, we prefer to evaluate frontier models without charge, and we do not proactively offer paid evaluations of frontier models to their developers. If a frontier AI company asks us for a paid evaluation, we may accept it at fair market value, determined by reference to our published price list or comparable market prices, with pricing decisions documented. We disclose any such evaluation in the report and on our website, and ask the company to disclose it too. Paid safety evaluations of AI applications built for specific industries, such as medical agents, are outside this commitment.
3. No contingent compensation. Payment for an evaluation never depends on its results.
4. No control by frontier AI companies. No frontier AI company holds a controlling stake or voting control in Fangcun AI; holds its voting shares or a significant proportion of its overall shares; or controls a seat on its board of directors.
5. No investment in frontier AI companies. Fangcun AI holds no direct equity or debt in frontier AI companies, or assets directly tied to their value. Indirect holdings through diversified investments such as index funds are excluded.
6. Donations. We do not accept donations from frontier AI companies or their employees. For any donation of 0.1% or more of our annual income whose source is unclear, we confirm that it was not directed by a frontier AI company or its employees. The 0.1% threshold is calculated on donations aggregated over a single fiscal year and may not be circumvented by splitting. We take reasonable steps to identify our donors and keep records of that verification.
7. Non-monetary support. We accept free compute credits, or model access beyond public channels (such as early access or internal versions), from a frontier AI company only if losing them would not materially affect our work, and we disclose them in any evaluation that uses them. API services purchased at standard prices through public channels are not considered such support.
8. Annual disclosure. Each year we publish the share of our funding, both revenue and donations, that comes from frontier AI companies, their employees, and our direct competitors.

5. Individual Conflicts and Recusal

Personnel must report potential conflicts when they join, every six months thereafter, whenever a new conflict arises, and before taking part in any evaluation of a named company. As a guiding principle, any relationship that, if made public, could give others reasonable grounds to question the impartiality of an evaluation should be reported.

Holdings through index or mutual funds, and support roles carried out under qualified supervision, do not require recusal.

6. Disclosure in Published Evaluations

Every published evaluation, and every non-public report we deliver, must state whether any of the following apply, with details where they do:

• Payment from the evaluated company or its direct competitors for the evaluation
• Significant funding from the evaluated company, its employees, or its direct competitors
• Equity in Fangcun AI held by the evaluated company, its employees, or its direct competitors
• Equity held by evaluation personnel in the evaluated company or its direct competitors
• Evaluation personnel who also work for the evaluated company or its direct competitors
• Other agreements with the evaluated company that could affect independence
• Any other relevant conflict of interest

7. Review and Enforcement

Potential conflicts and suspected violations are reported to the operations lead or to the person selecting the evaluation team, who refers them to the leadership team for review. If the CEO's impartiality is in question, the board of directors reviews the case instead. If a director has a personal interest in a case, that director steps back and the remaining disinterested directors review it.

While a case is under review, the person concerned steps back from the evaluation. A violation can lead to removal from the evaluation, a correction to the published report, and disciplinary action. Disclosures and review decisions are recorded and kept on file. A person subject to a decision may appeal to the leadership team. Personnel who report conflicts or violations in good faith are protected from retaliation, and their identities are kept confidential.

8. Current Status

As of October 2026, Fangcun AI has not carried out any paid evaluation of a frontier model. In the most recent fiscal year, we received no revenue or donations from frontier AI companies, and no free compute credits or model access beyond public channels, such as early access or internal versions. All models we evaluate are accessed through public APIs at standard prices.

9. Contact

We welcome questions about this policy, and concerns about the independence of any Fangcun AI evaluation, at contact@fangcunleap.com.

10. Revisions and Language

We review this policy at least once a year. Material changes are published with a new version number and effective date.

This policy is published in English and Chinese. If the two versions differ, the English version prevails.

1. Purpose

Safety evaluations sometimes uncover flaws in AI systems that could cause harm if exploited or left unaddressed. Notifying the developer early, so that a problem can be fixed before it becomes widely known, is a responsible approach. Timely publication also helps the wider industry and the public understand the risks.

This policy sets out how we balance both goals: working with developers to address identified issues while sharing our research openly. It is designed to meet condition 5.4 of AEF-1, the AI Evaluator Forum's minimum operating conditions for independent third-party AI evaluations.

2. Scope

This policy applies to every AI system Fangcun AI evaluates, whether it is publicly available or accessed under an agreement with its developer. It covers findings made by everyone involved in our evaluations, including employees, interns, contractors, and advisors. The Fangcun AI Responsible Disclosure Policy therefore applies more broadly than the Fangcun AI Independence and Conflict of Interest Policy, which covers only evaluations of named frontier AI companies: responsible disclosure is relevant to every system we examine.

3. Types of Findings

We handle findings in two categories.

For behavioral findings, we weigh how severe and widespread the potential harm is, whether the developer could fix it before publication, and whether the behavior is already publicly known.

4. How We Notify

We send findings to the developer's published security or safety contact, with enough detail to reproduce them. Where a developer has no published contact, we use the most direct channel available and keep a record of our attempts.

Developers can reply to a notification at contact@fangcunleap.com. We carefully consider their response, including progress on a fix and any factual corrections, and update our report where appropriate. Decisions on publication are made independently by Fangcun AI.

5. Exceptions

• Information hazards. We publish the finding itself and the risk it poses, but withhold specific details that would mainly help malicious actors, such as weapons-related content or directly reusable attack methods. This applies to all models alike. Developers may receive more detail than the public so that they can address the issue. Where a vulnerability cannot be fixed and is likely to be exploited, we treat it as an information hazard and restrict its dissemination accordingly.
• Evaluation integrity. We may withhold specific prompts or attack strings to keep benchmarks valid.
• No available contact. If we cannot reach a developer through any reasonable channel, we may publish without advance notice.
• Uncooperative developers. If a developer retaliates for a notification, or lacks a reasonable vulnerability disclosure policy, we may publish without advance notice.
• Agreements. Where an evaluation is subject to a nondisclosure agreement, the agreement prevails only to the extent that it does not conflict with mandatory legal requirements or the core purposes of this policy. No agreement may exclude our statutory disclosure obligations.
• Privacy. Sensitive personal information found during an evaluation is removed before publication.
• Host-country compliance. Where the developer is established in China, the evaluated system is provided to the Chinese market, or publication takes place in China, Chinese laws and regulations prevail over this policy. In particular: no vulnerability information is published before the developer has issued a fix, unless earlier publication is genuinely necessary, in which case it is jointly assessed with the developer and reported to the competent authorities as required; vulnerability information is published together with remedial or preventive measures; publication during periods of major national events complies with the applicable requirements; unpublished vulnerability information is not provided to any overseas organization or individual other than the developer; and internal management of vulnerability information is maintained to prevent leaks.

6. Publication

Security vulnerabilities are published within the timeframe set out in Section 3. Behavioral findings are published when doing so serves public understanding of AI risk. Each published evaluation states whether the developer was notified in advance and, if so, when. For attack paths that are probabilistic, we weigh the marginal utility of publication, including whether publication itself would materially increase the likelihood of misuse, before deciding what to publish.

7. Contact

Developers responding to a notification, and anyone who wants to report a concern about a Fangcun AI evaluation, can write to contact@fangcunleap.com.

8. Revisions and Language

We review this policy at least once a year. Material changes are published with a new version number and effective date.

This policy is published in English and Chinese. If the two versions differ, the English version prevails.

1. Services

• We provide AI security SaaS services billed by usage. Specific prices are as published on our official website.
• We reserve the right to upgrade or adjust our services. We will give advance notice of material changes.

2. Accounts

• Please register with a genuine, valid email address. The account holder is responsible for all actions taken under the account.
• An API key is treated as the account holder's authentication credential. Keep it secure. If a key is exposed, rotate it immediately and notify us.

3. Acceptable use

• You must not use our services for purposes that violate the laws and regulations of the People's Republic of China.
• You must not conduct unauthorized scanning, stress testing or reverse engineering of our services.
• You must not bypass billing, rate limits or quotas.
• We may suspend or terminate accounts that violate these terms.

4. Billing

• Services are billed by usage. Please refer to the pricing on our official website for details.
• Wallet balances are prepaid and cannot be refunded in cash. After service termination, you may request a voucher of equivalent value for the unused balance.
• Please contact us about any billing dispute within 30 days of the disputed charge.

5. Intellectual property

• Our services and the related intellectual property belong to Fangcun Leap.
• You retain all rights to your own data and content.

6. Disclaimer

• The services are provided “as is.” We make commercially reasonable efforts to maintain service quality but do not give an absolute guarantee regarding the results of service calls.
• We are not liable for losses caused by force majeure, third parties or use in violation of these terms.
• To the extent permitted by law, we are not liable for indirect or incidental losses, and our total liability will not exceed the fees you actually paid us in the preceding 12 months.

7. Governing law

• These terms are governed by the laws of the People's Republic of China. Disputes will first be addressed through amicable negotiations. If no resolution is reached, the dispute will be submitted for litigation to the people's court with jurisdiction at our company's location.

Contact

For questions about these terms, contact info@fangcunleap.com