Who handles your information and how to contact us
Dingbian County Wangshi Boxin Trading Technology Co., Ltd. is responsible for personal-information processing for this free member service, under the operating brand Chyson Media, China. Contact address: Xizheng Street, Dingbian County, Yulin, Shaanxi, China. Privacy requests and support: support@ctcsol.org.
During this phase, registration and member functions are temporarily unavailable to people located in the European Economic Area (EEA) or the United Kingdom when registering or using the service. Location, rather than nationality, determines this scope. Public resources in the three languages remain readable worldwide. support@ctcsol.org is the operator’s contact channel, not the contact of an EEA or UK representative or a data protection officer. If the service scope changes, we will first put the relevant arrangements in place and update this notice.
Information collected
Account information includes email, identity-provider account identifiers, verification status, sign-in method, interface language and necessary records of agreement acceptance. Q&A information includes question titles and text, submission times, status, daily-count records, teacher answers and necessary task links and processing records. Security and communication information may include IP addresses, request times, errors and security events, email addresses and delivery status. Do not put identity documents, passwords, payment details, sensitive private information or unnecessary information about others in questions. This free service does not require card or payment-account details.
Regional checks also use your location-eligibility confirmation and country or region estimates associated with network requests. They do not require your nationality, passport or precise geolocation. These estimates may be inaccurate; member functions remain unavailable when the region cannot be confirmed, and you may contact support for a review.
Purposes and grounds for processing
We use necessary information to establish and verify your account, provide the Q&A you request, enforce the two-question daily limit, deliver teacher answers and handle support requests. These activities rely on appropriate grounds under applicable law, such as necessity to perform the service agreement. Necessary security, abuse investigation and legally required retention are assessed separately by purpose and applicable ground; we do not label every purpose as consent. Only processing that requires consent relies on the relevant consent, obtained separately where the law requires. Accepting the membership terms is not consent to marketing or publishing questions and does not waive cross-border processing requirements.
Location-eligibility confirmation and country or region estimates are used only as necessary to apply this phase’s membership scope and review related queries. They are not nationality determinations or legal-applicability conclusions for all regions.
Email and Google sign-in
Email/password and Google sign-in use Google/Firebase identity services. Email passwords are forwarded to Firebase over encrypted transport for verification; the member server does not persist your plaintext password. Google sign-in verifies identity and email; it does not authorise access to your Gmail inbox or Google Drive. Firebase states that Authentication processes identity information in the United States. The identity service may send verification, password-reset and security emails. Do not share verification links or passwords with teachers.
Teacher answers and email handling
During the first phase, the operator personally views and answers questions as the authorised teacher. Questions are not distributed to external teachers or sent to an external model to generate answers automatically. The platform or task email supplies only the information needed for the question, not the student’s full account information or password.
Each teaching task uses a question-specific reply address. The teacher can reply from a mailbox they use; the system checks the task credential and permissions before linking the answer to the corresponding question. A single sender address is not the sole identity check. Answers appear in the member dashboard, and necessary notifications or answers are sent to the registered email address. Emails may contain question or answer text. Use a mailbox you can manage securely, and do not include unrelated sensitive information in questions or replies.
Providers, access and processing locations
To provide this service, the following providers and the operator process information to the extent needed. Processing may cross the borders of your country or region.
Google / Firebase Authentication: email addresses, account identifiers, verification and sign-in information, and necessary IP and security signals, for email/password or Google authentication, account security and verification or reset emails. Firebase states that Authentication identity information is processed in the United States.
Cloudflare: access routing, country or region estimates, bot and security protection, incoming and outgoing email and an event database over its global network. It processes necessary network and browser security signals, email addresses, question and answer content, and delivery and event identifiers. The mail database’s current primary location is labelled western North America; this does not mean that all edge processing, mail or copies remain only in that region.
BandwagonHost / IT7 Networks Inc.: hosting of the member application and database, including account and language information, questions and answers, daily counts, agreement confirmations and necessary audit records. The current VPS data centre is in San Francisco, United States.
The operator performs necessary administration, teaching and privacy-request handling in China. First-phase teaching tasks and replies use a Google/Gmail mailbox. Support email sent to support@ctcsol.org is forwarded by Cloudflare to the operator’s Tencent QQ Mail/Foxmail mailbox. Google/Gmail processes the corresponding tasks, questions, answers and message identifiers; Tencent Mail processes support requests, contact details and message content. Both are used to carry out the respective communications. Student notifications pass through the email provider chosen by the student. Mail providers may process mail in the regions where they operate; this service does not guarantee that email copies remain in one country. We do not supply member marketing lists to partners. The provider privacy pages below give their processing information and contact routes. You can also contact support@ctcsol.org to ask us to coordinate rights requests concerning this service.
Google / Firebase: privacy, security and contact
Cloudflare: privacy notice and contact
BandwagonHost / IT7: privacy notice and contact
Google / Gmail: privacy notice and contact
Tencent Mail: Tencent Privacy Protection Platform and contact
International processing notice and confirmation
The registration or sign-in page displays international-processing information in a separate section. Read it and this privacy notice first. Clicking a sign-in, registration or confirmation-saving button explicitly labelled “Agree to international processing and…” gives consent to the described processing of account identity, questions and answers, email and necessary security information for authentication, teaching answers, notifications and security by Google/Firebase, Cloudflare, BandwagonHost/IT7, the Gmail and Tencent Mail providers described above and the operator in the United States, across Cloudflare’s global network and in China. The same click also confirms the displayed declarations about age, the terms, reading the privacy notice and location. No additional checkbox is required; viewing the page does not record consent. We record the explicit button method, policy version and time, without describing the action as a checkbox selection. This does not authorise marketing, publication of questions, expanded purposes or additional disclosures.
The current member functions depend on these overseas identity, hosting and mail services. Without this consent, you cannot currently create or continue using membership, but you may still read public resources and contact support. You can withdraw consent or request access, correction or deletion of cross-border data through support@ctcsol.org. We will verify your identity, handle the request and explain the effects on your account and outstanding questions. Withdrawal does not affect earlier lawful processing. Regional restrictions or inability to sign in do not block this support route.
Cookies, local storage and security
The necessary __Host-ctcsol_session cookie lasts 30 minutes, is host-only and uses Secure, HttpOnly, SameSite=Lax and Path=/ attributes. The server-memory sign-in session lasts at most 30 minutes; temporary Google verification state lasts at most 5 minutes and is used once. The browser local-storage item ctcsol-language stores only the interface language, with no automatic expiry; you can clear it in your browser. Account language is also kept with the account. Member pages do not load optional visitor analytics. Cloudflare Turnstile bot protection loads only when needed for an enabled authentication action and processes IP, browser and security signals. We use access controls and encrypted transport, but do not promise a risk-free internet service.
Retention, account closure and deletion
We retain information for the shortest time needed to provide the service, handle a specific request or dispute, or meet an applicable obligation. The operator manually reviews and clears records against the criteria below; storage convenience is not a reason for indefinite retention.
Accounts, language settings, questions and answers: while the account is in use, they support sign-in, learning history and Q&A. After account closure, a valid deletion request or the end of the relevant service purpose, information no longer needed is cleared. If an item must remain for an unresolved dispute or legal obligation, its reason and release condition are recorded and other uses restricted.
Usage counts, agreement confirmations and security records: only records needed to enforce the allowance, prevent duplicate handling, verify authorisation or investigate a specific incident are retained. They are cleared when those purposes end and no other applicable retention duty remains. Incoming teacher mail, parsed candidates and notification-queue bodies: these are kept as needed to check delivery and answer matching, retry failures or handle a specific complaint. Unneeded content and copies are cleared after the matter is resolved. Masking recognised reply credentials does not automatically remove other personal information in the body.
Backups and email copies are handled separately. Backups are limited to recovery or necessary checks and must not revive an ended service purpose. Recorded closure, restriction or deletion requirements must be reapplied on restoration, and copies cleared when the corresponding recovery purpose ends. For copies controlled by identity or mail providers, we use their available request channels and check the outcome. If a copy cannot be cleared immediately, we explain the reason and follow-up handling.
There is currently no automatic deletion process based on a fixed number of days. Expiry of a reply address or session, completed mail processing or account suspension does not mean all records have been deleted. The operator handles requests manually and explains what was completed, any reason for retention and the limits. Unverified outcomes are not described as completed deletion.
Your choices, rights and how to make a request
Contact support@ctcsol.org to request access or a copy, correction, erasure, account closure or restriction, or to exercise applicable rights to object, withdraw consent or transfer data. Briefly describe your request and use your registered email where possible; do not send passwords or full identity documents at the outset. We use the minimum identity checks necessary, record progress and outcomes, explain any part we cannot fulfil and follow applicable legal deadlines. Withdrawing consent does not affect prior lawful processing. If processing is necessary for a service, we explain how stopping it affects that service. You may also complain to a competent authority or seek legal remedies; using this free service does not require giving up those rights.
Children, public use and changes
Registration in this phase is not open to anyone under 18. Contact support about a possible minor’s account or sensitive information collected by mistake. Registration does not authorise public display of your learning records, provision of marketing lists to partners or training of external models. A proposed new purpose requires a separate review of its legal ground and any necessary authorisation. Material privacy changes will be appropriately notified; the effective text carries its date and version. Where a change requires consent, it will be obtained separately rather than treating continued browsing as a universal substitute.