1. Scope and operator
杭州通微人工智能科技有限公司, operating under the Sagaway brand (“we”), provides LabMind (研云) and Sagaway research services. This policy covers the labmind.sagaway.cn console, the LabMind iPhone and iPad apps, and their associated account, task, conversation, cloud drive and support services. Product policies, terms, the AI notice and iOS support documents are hosted on www.sagaway.cn and www.sagaway.ai; the console provides product operations. This policy also explains access records and language preferences for these product document pages. Other brand activities on the official website have their own applicable notices. Our privacy contact is privacy@sagaway.ai.
You can manage tasks from a mobile device, use an available cloud executor, or connect your own computer to process tasks. Processing depends on the features you use, execution location, model, cloud sync settings and country or region selection. Third-party websites, services you configure and other software on your connected computer are governed by their providers’ policies.
This policy explains personal information processing. The Terms of Service explain service use, and the AI and Data Processing Notice explains models and executors in more detail. We do not sell your personal information or place advertising in the service. Permission prompts and feature-specific notices supplement this policy. Reading this policy does not by itself authorize every form of processing.
2. Information, sources and purposes
We process information as needed to provide the features you choose, protect accounts and services, handle transactions and support requests, and meet legal obligations. A feature may use only some of the categories below.
| Information | Sources and circumstances | Purpose |
|---|---|---|
| Account and profile | Mobile number, verification records, user identifier, display name, and email, institution or role you provide; password verification information where password authentication is used | Registration, authentication, profile management, account security and service administration |
| Device and security | IP address, login device description, device identifiers, operating system and app version, login sessions and audit records | Recognize devices, manage access, revoke sessions, prevent abuse and investigate security issues |
| Tasks and conversations | Instructions, messages and history, model responses, tool calls, approval decisions and answers, command output and task artifacts | Process tasks, show progress and results, retain history and enable available cross-device access |
| Files and research content | Selected photos, files and documents; cloud drive names, paths, sizes and versions; projects, records, literature or other work content created in the service | Process attachments, manage work and documents, store, preview, download, share and collaborate |
| Memory and private values | Memory you save or enable; private value names, purpose descriptions, values and conversation access records | Provide enabled memory context and allow authorized execution devices to use private values |
| Region and feature choices | Selected country or region, model, execution location, service eligibility and consent status | Determine available services, retain choices and apply regional processing rules; region selection is not GPS location |
| Entitlements, transactions and invoices | Allowances, balances, plan or subscription status, orders, usage, bills and payment results; invoice title, tax identifier, delivery email, address and telephone, and bank and account details where applicable and provided for an invoice | Provide entitlements, calculate fees, handle orders and after-sales requests, reconcile accounts, issue invoices and meet financial obligations |
| Feedback and contact | Feedback, complaints, privacy requests, contact details and screenshots or other materials you choose to send | Investigate issues, respond to requests, resolve complaints and provide support |
| Product document page visits | IP address, requested path, browser information, necessary access or security logs, and your language choice when visiting product document pages | Serve pages, determine a default language, retain your choice, troubleshoot access and protect website security |
| Diagnostics and operation | Crash traces, errors, timestamps, device and version details and relevant log excerpts | Find faults, improve stability, investigate anomalies and maintain security |
| Content and security review | Input, output, risk flags, necessary excerpts and review records for relevant features; excerpts may still contain personal information | Detect and address violations, security risks or abuse, handle appeals and preserve evidence as legally required |
3. Files, memory and sensitive information
Messages, work files, photos, memory and tool output may contain personal information, trade secrets, health information, identification details or other sensitive content. Information remains sensitive when included in a work file. Submit only what is needed, ensure you are authorized to use and disclose it, and meet applicable notice and authorization requirements for information about others.
Enabled memory can become context for AI tasks. Do not put passwords, verification codes or keys in memory or ordinary messages. The Private Values feature manages values separately: the model can receive a name and purpose, while an authorized execution device can use the actual value when running a command. Cloud-synced private values are stored encrypted, but the server can decrypt them in authorized workflows. This is not end-to-end encryption that only you can decrypt.
Authorize only the values needed for a particular conversation and revoke access when no longer needed. Execution devices can run commands and access external networks. Incorrect instructions, malicious files or prompt injection can cause authorized information to be misused or transmitted externally. Access controls and encryption do not remove all risks.
4. Permissions, speech and notifications
Voice input uses on-device speech recognition when supported by the app and device. Otherwise, Apple’s speech recognition servers may process audio. Once you send the recognized text, it follows the task processing route like other input. Apple’s processing is governed by its privacy policy: https://www.apple.com/legal/privacy/. Voice input does not mean audio always stays on your device.
Manage these permissions in iOS or iPadOS Settings. Declining or withdrawing permission affects the related feature and does not require permission unrelated to that feature. Current product features do not require contacts, health data, Bluetooth or precise GPS location permissions. Device permissions are separate from authorization to share information with a third-party AI service.
| Permission or capability | Purpose | Your choice |
|---|---|---|
| Photo selection or library access | Select attachments, upload to the cloud drive or set a workspace background; the system picker varies by device | Cancel selection or adjust accessible photos in system settings |
| Camera | Take a photo for upload or a relevant task when you choose to do so | Declining does not prevent text or other features that do not need the camera |
| Add to Photos | Save an image you select to the system photo library | Use another available saving method if permission is declined |
| Microphone and speech recognition | Convert speech to text when you start voice input | Stop input, use the keyboard or revoke permissions in system settings |
| Notifications | Provide available local task and approval reminders | Decline or disable in system settings; timely delivery when the app is closed is not guaranteed |
| System file selection and saving | Read selected attachments or save downloads to your chosen location | Choose the files and location yourself; canceling does not grant file access |
5. AI, providers and sharing
Third-party model services may process AI tasks. Requests may contain your current input, necessary message history, attachments or accessed files, enabled memory, tool instructions and tool output. Even when a task runs on your own computer, model requests may be sent over a network. “Local” execution does not mean an offline model or that all information stays on the device.
Model providers, processing locations and conditions vary with the model and service route. Review the notices provided with model selection and the relevant feature before submitting content. Processing that requires explicit consent or separate international-transfer consent must be covered by the relevant notice and authorization. You may decline, use an available alternative or stop the feature. To withdraw consent or ask about specific recipients, contact privacy@sagaway.ai.
Other providers may support authentication, SMS, hosting and object storage, execution, payments, content security review and troubleshooting. Relevant services include Alibaba Cloud SMS and object storage. Available model routes may include DeepSeek, Alibaba Cloud Model Studio, and Claude or GPT models supplied through associated model and forwarding services. A model brand is not necessarily the only recipient; the original model provider’s terms do not establish the retention or training conditions of every forwarding service. Ask our privacy contact about recipients for a specific feature or task.
We provide information needed for the relevant feature and arrange security and confidentiality requirements according to providers’ roles and applicable law. Relevant web transactions may use WeChat Pay, with payment information handled by Tenpay/WeChat Pay; other channels are identified at checkout. Payment providers apply their policies. Do not email full payment card details or payment passwords to us. Alibaba Cloud service information: https://www.aliyun.com; DeepSeek Privacy Policy: https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html; Tenpay privacy entry: https://www.tenpay.com/v3/helpcenter/low/privacy.shtml. Public provider policies are informational and do not replace terms applicable to the specific processing route.
When you share a file, invite collaborators or connect a task to a third-party service, information is provided to recipients you choose. We may also disclose information as necessary to meet legal obligations, respond to lawful authority requests or protect significant lawful interests. Transfers in a merger, reorganization or asset transaction must meet applicable notice and protection requirements; a change in purpose or processing method requires new consent where the law requires it.
Model providers’ retention and training or improvement practices depend on the service, configuration and applicable terms. Using LabMind does not mean that every third party never retains input or never uses it for training. Before submitting confidential work, check the conditions for the selected processing route and your institution’s requirements.
6. Storage and international processing
Information may be stored on your device, associated backend systems, object storage or the execution device you select. Login credentials use the iOS or iPadOS system Keychain. Preferences, caches, downloads and pending diagnostics may be stored on-device. Cloud conversations, files, memory and private values are stored according to the feature and sync settings. The labmind.sagaway.cn console uses browser local storage for login tokens, theme and navigation preferences, input history and feature caches. You can sign out or clear browser storage, but may need to sign in and set preferences again.
Product document pages use a language cookie (sgw_lang, retained for up to one year) and a browser language preference (sagaway-lang) to remember your choice. Session storage (lg-lite-2) retains a display performance fallback choice for the current browsing session. Before a manual choice, the English entry’s edge service may use country or region information in a network request to choose a default language; this is not GPS location. Use the language controls or delete cookies and browser storage to reset your preference. Edge delivery and external website resources such as icons or Traditional Chinese conversion resources may send the IP address, browser information and requested resource to the relevant network provider. Merely reading these documents does not give the official website your console login token.
We operate associated backend services in mainland China. Selecting a model, execution device or other service outside mainland China may result in processing elsewhere; access from abroad may also involve international network transfers. We do not promise that all information is processed only in mainland China. The relevant transfer notice should identify recipients, purposes, information involved, locations and ways to exercise your rights.
International processing subject to applicable law requires a lawful basis, appropriate safeguards and any required notice or separate consent. General device permissions do not substitute for these requirements. If you do not accept a route, do not send data through it and select an available alternative.
7. Retention, deletion and security
We retain information for as long as necessary for the purposes described here, considering your use of task history and files, account status, security incidents, contractual obligations, disputes and legal requirements. When a purpose is complete and retention is no longer needed, we delete or anonymize the relevant personal information. Transaction, financial and security records may be retained as required by law and are not used for unrelated purposes.
Deleting a conversation, moving a file to trash, emptying trash and physically destroying it are different actions. Emptying trash moves a file into retained storage that you cannot access. Conversation deletion does not automatically physically delete all attachments, historical stored objects or backups. Authorized personnel may still access retained objects as needed for security investigation, evidence preservation or legally required handling. Removing or disabling memory does not retract content already included in conversation history or sent to a model.
To request deletion of personal information, contact privacy@sagaway.ai and specify the account, conversations, files or other data involved. We check what remains stored and the retention basis, handle it under applicable requirements and explain records that cannot be deleted and why. An item hidden from the interface or cleared from trash is not evidence that all physical deletion is complete. Backups and provider copies also require handling according to the request scope and applicable requirements. You or the recipient manage copies exported to Files, Photos, your computer or third-party recipients.
Signing out, revoking a permission, turning off cloud sync or uninstalling the app does not close the server account or automatically delete all cloud content. Review feature notices before changing sync settings; existing cloud data and new data may be stored differently.
We use transport encryption, account authentication, access controls and appropriate storage protections. Diagnostics and security logs may be linked to your account, and errors may contain task-related excerpts. Avoid unnecessary sensitive content in issue reports. iPad settings offer a crash reporting control; contact the privacy email about other diagnostic processing concerns.
No information system guarantees absolute security. If you find an account or information security issue, stop affected operations and contact us promptly. We take remedial action and provide notices for personal information incidents as required by applicable law.
8. Legal bases and choices
In mainland China, we process personal information under circumstances permitted by applicable law, including your consent, necessity to enter into or perform a contract to which you are a party, and necessity to meet legal obligations. Sensitive information, international transfers and other processing requiring separate consent are subject to the relevant separate notice and consent requirements.
Where other regional laws apply, processing may be based on the service contract, consent, legal obligations, and legally permitted and balanced legitimate interests such as service security and troubleshooting. Consent-based processing allows withdrawal; you may object to applicable legitimate-interest processing. Accepting one optional feature does not authorize every other purpose.
Some information is needed for sign-in, a task you request or a transaction. You may decline to provide it, but that feature may be unavailable. Declining optional profile information or device permissions does not affect features that do not require them.
9. Your rights and account closure requests
To the extent provided by applicable law, you may access, copy, supplement or correct personal information, request deletion or account closure, withdraw consent, and exercise restriction, objection or portability rights. Use available profile editing, conversation or file deletion, device management and permission controls, or send a request to privacy@sagaway.ai.
For account closure, use the subject “Account closure” and provide a mobile number or account identifier that lets us locate the account, together with the requested scope. We use necessary and proportionate identity checks, confirm account ownership and records that must be retained, handle the request under applicable law and report the outcome. Do not email passwords, verification codes, login tokens or keys.
Closure may remove access to tasks, files, allowances and history. Save materials you need beforehand. Balances, outstanding transactions and other contractual matters are handled under applicable rules. Account closure and cancellation of a subscription managed by a third-party channel are separate actions; manage such subscriptions through that channel as well.
We respond within the time required by applicable law. If technical constraints, identity verification, legal retention or others’ rights prevent full fulfillment, we explain why and available next steps. You may complain to our privacy contact or the competent privacy authority where you live. Where European data protection law applies, you may complain to your local data protection supervisory authority.
10. Children and younger users
The service is for research and work and is not designed for children. Minors should use it with their guardian’s knowledge and consent and meet local age and authorization requirements. Processing personal information of children under fourteen requires guardian consent and the corresponding protections where applicable.
If you are a guardian and believe a child has provided information without the required authorization, contact privacy@sagaway.ai. We will investigate and handle it under applicable requirements.
11. Updates and contact
We update this policy when features or processing change and show the update date. We communicate material changes through product notices, website announcements or another reasonable channel. Where new consent is legally required, we obtain it separately; continued use does not replace required consent.
Privacy questions, rights requests and complaints: privacy@sagaway.ai. Product and service support: business@sagaway.ai. Operator: 杭州通微人工智能科技有限公司 (Sagaway). Provide only information needed for your request.