BIMENT
中文Account

BIMENT Privacy Policy

Version: v1.4 Published: August 31, 2026 Effective: August 31, 2026

Anhui Baimeng Technology Co., Ltd. (Chinese registered name: 安徽百梦特科技有限公司; “BIMENT”, “we”, “us”, or “our”) respects your personal information and privacy. This policy applies to the BIMENT website, iOS App, Android App, and their account, storefront, product registration, device connection, repair, after-sales, and rider-community services.

On first launch, the App displays this policy and the User Agreement before initializing business services or third-party SDKs. The App accesses BIMENT services or initializes OneBleKit only after you tap “Agree and Continue”. The international Android package does not include the Alipay client SDK and does not provide ordering or payment. Mainland-China distributions that support Alipay invoke it only when you actively choose Alipay for payment. You may exit the App if you do not agree. We provide separate notice and obtain consent where sensitive personal information or applicable law requires it.

1. Controller and Contact

2. Our Principles

We process personal information lawfully, fairly, transparently, in good faith, and only to the minimum extent necessary for clear purposes directly related to the service. We do not sell personal information or use it for cross-app advertising tracking.

3. Information We Process and Why

3.1 Browsing, Operations, and Security

To display pages, connect to our services, protect accounts and systems, and diagnose faults, we may process IP address, access time, request path and result, basic device and operating-system information, language, network type, App version, crash information, and error or security logs. Network-operation and security logs are retained as required by law and security needs, generally for no less than six months.

3.2 Registration, Sign-In, and Profile

Depending on the sign-in method you choose, we process your phone number or email address, verification-code delivery and verification status, password hash, session information, user ID, display name, avatar, date of birth, bicycle type, approved customer identity, and account status. We do not store plaintext passwords. Verification codes generally expire within five minutes and are invalidated after successful use.

Mainland China accounts may use supported phone or email authentication and, subject to server authorization, commerce, orders, and payment. International accounts use email authentication and may use product, device, community, account, and customer-service features; ordering and payment are not currently available. Changing the App language does not change the service region or grant additional capabilities.

Android stores its session and accepted privacy-policy version in App-specific local storage. iOS stores sign-in tokens in the system Keychain. Signing out or deleting an account clears the corresponding local session.

3.3 Storefront, Orders, Payments, and Fulfilment

When you browse products, add items to a cart, place an order, pay, request a refund, submit a review, or buy again, we may process the product, SKU, quantity, account price tier, discount, order number, amount, payment method and status, payment transaction identifier, refund status, and review content. For physical delivery, we process the recipient name, phone number, address, delivery method, logistics, and receipt information. If you submit an offline-transfer receipt, we process only the image you actively select.

Where a mainland-China App distribution supports Alipay, it invokes the Alipay client SDK only when the server indicates that Alipay is available and you actively choose it. We provide the merchant order number, amount, and product summary required for the transaction and receive the client-side result. A client message such as “completed” or `resultStatus=9000` does not by itself mean that an order has been paid. Payment status is based on a trusted payment-provider notification and server-side verification. The international Android package does not contain or invoke the Alipay SDK.

3.4 Product Registration, Warranty, and Repair

When you register or transfer a product or request repair or after-sales service, we may process its serial number, model, registration date, purchase and transfer record, fault description, repair status, return and delivery information, and images you actively select. When you use the camera to scan a serial number, the live image is used only for on-device recognition. We do not save or upload a scan video or photo solely because you scanned the code.

3.5 Rider Community and Human Review

A registered user with a verified phone number or email address may submit training posts, product Praise & Critique posts, images, comments, and replies, and may like, save, follow, block, report, or delete content they are entitled to delete. We process the user ID, public display name and avatar, post and images, related product, interactions, publication time, review status, report reason, appeal, and moderation record.

New posts, images, comments, and replies first pass real-time deterministic rules and then, where applicable, are sent by the BIMENT server over HTTPS to the Kimi Open Platform API for automated text or image safety review. Data may include the opaque internal post or reply ID, content, related product, necessary parent-post context, rule signals, and image content that you actively submit. We do not send your phone number, email address, address, order, payment, or ride-device data for this review unless you put such information into the submitted content or image yourself.

High-confidence results may be automatically approved or rejected; uncertain results, reports, safety or privacy disputes, provider failures, and retry exhaustion are sent to authorized staff for human review. Automated moderation is used only to assess compliance with publication rules, not for profiling, credit assessment, differential pricing, or purchase eligibility. Before approval, content is visible only to its author. After approval, the display name, avatar, body, images, related product, interaction counts, and publication time may be visible to other users. Phone numbers, email addresses, internal review records, and rejection reasons are not public. You may contact service@biment.cn to request an explanation, make a complaint or appeal, and request human review.

Do not include identity documents, phone numbers, detailed addresses, order numbers, precise route start or end points, product serial numbers, or other unnecessary sensitive information in a post or image.

3.6 Bluetooth Devices and Ride Data

The App invokes Bluetooth only after you actively choose to scan, connect, configure, calibrate, or use a firmware feature. It then processes nearby device names, addresses or identifiers, and signal strength, and after connection may process the serial number, hardware and firmware versions, battery level, services and characteristics, live power, cadence, pedal balance, calibration, and device-setting results.

Live ride data is currently parsed and displayed locally by default and is not actively uploaded to BIMENT servers. A firmware check may send the device model, hardware version, firmware version, and battery level to BIMENT services.

On Android 11 and earlier, the operating system classifies Bluetooth scanning under location permission. The App may therefore display a location-permission prompt on those systems, but BIMENT does not use that permission to read, store, or upload geographical location. Android 12 and later use Nearby Devices permission. The iOS App uses the system Bluetooth permission and does not request location permission for Bluetooth.

3.7 Photos and Camera

When you set an avatar, publish community content, submit after-sales material, or upload an offline-transfer receipt, the App uses the system photo picker and reads only the images you actively select for that action. It does not continuously read your photo library. Refusing or cancelling access does not affect features that do not require an image.

The camera is used only when you actively scan a product serial number. You may enter the serial number manually instead.

3.8 Customer Service, Complaints, and Notifications

When you contact customer service, submit a complaint, report content, or appeal a decision, we may process your name or preferred form of address, contact details, communication content, attachments, and the related account, order, product, and handling record.

SMS verification codes are delivered through Alibaba Cloud SMS, and email verification codes and account-security messages are delivered through Alibaba Cloud Direct Mail. Verification messages do not include marketing advertisements.

4. Permissions

| Platform and permission | Purpose | Effect of refusal |
| --- | --- | --- |
| Android Nearby Devices / Bluetooth scan and connection | Scan for, connect to, and manage supported BIMENT power meters after a user action | Device connection is unavailable; storefront and community remain available |
| Location on Android 11 and earlier | Satisfy the operating-system requirement for Bluetooth scanning; not used to determine location | Bluetooth scanning is unavailable on those systems |
| iOS Bluetooth | Scan for, connect to, configure, and calibrate supported BIMENT power meters after a user action | Device connection is unavailable |
| Android / iOS camera | Scan a product serial number after a user action | You may enter the serial number manually |
| Photos selected by the user | Avatar, community, after-sales, and transfer-receipt images | The corresponding image cannot be submitted; other functions remain available |
| Network access | Connect to BIMENT services, synchronize content, and submit requested business data | Online functions are unavailable |
| Android network and Wi-Fi state (normal permission) | Determine network availability and type; in a mainland-China distribution that supports Alipay, necessary network state may also be used for a user-requested payment-security check | Connectivity or payment-security checks may be unavailable; this is not used to read Wi-Fi passwords or actively connect to Wi-Fi |

Permissions are requested only when the corresponding feature is used. The current Apps do not request contacts, SMS-reading, call-log, microphone, or advertising-identifier permission. They do not process location for the purpose of obtaining geographical location. The Android 11-and-earlier location declaration exists only for Bluetooth compatibility. The Apps do not read files that you have not actively selected. You may disable permissions in system settings at any time; this does not affect processing that was lawful before withdrawal, but the related feature may stop working.

5. Local Storage

The website uses strictly necessary HttpOnly session cookies to maintain sign-in and may cache public content. The Apps locally store the sign-in session, public-content cache, cart, accepted privacy-policy version, and necessary device state. We do not use cross-site advertising cookies, marketing-profile cookies, or social-media tracking pixels.

Clearing website or App data removes the corresponding local session and cache. It does not automatically delete account, order, or other server records that must be retained for a service or by law.

6. SDKs, Open-Source Components, and Service Providers

We use the following providers and components on a minimum-necessary basis:

| Provider or component | Purpose | Information or permission that may be processed |
| --- | --- | --- |
| Shenzhen Huitek Electronics Co., Ltd. / OneBleKit 3.1.25 | Bluetooth scanning, connection, settings, calibration, and firmware transfer for supported BIMENT power meters | Bluetooth permission; compatibility location permission on older Android versions; device name, identifier, signal, version, and command data. The current integration does not send account, order, address, community, or advertising identifiers to this provider and does not enable telephone, SMS, or contacts modules |
| JourneyApps / ZXing Android Embedded | On-device recognition of product serial-number QR codes and barcodes | Camera permission and live scan image; the component does not independently upload the image |
| Alipay (China) Network Technology Co., Ltd. and related Alipay providers | Start a user-requested payment and perform payment-security checks only in mainland-China App distributions that include Alipay; the international Android package does not include this SDK | Merchant order number, amount, product summary, payment status, and device or network information processed by Alipay for security; see https://opendocs.alipay.com/common/02kiq3 |
| Beijing Moonshot AI Technology Co., Ltd. / Kimi Open Platform API | Server-side automated safety review of user-submitted posts, images, comments, and replies | Opaque internal content ID, body, related product, necessary parent-post context, rule signals, and actively submitted image content; see https://platform.kimi.com/docs/agreement/userprivacy |
| Alibaba Cloud Computing Co., Ltd. / SMS, Direct Mail, and ECS | Deliver verification codes and security messages; operate the website, API, database, and file service in mainland China | Phone number, email address, message content, account and business data, user-submitted files, and necessary logs; see https://terms.aliyun.com/legal-agreement/terms/suit_bu1_ali_cloud/suit_bu1_ali_cloud202107091605_49213.html |
| Logistics providers | Deliver a physical order that you submit | Recipient, phone number, address, product, quantity, and order identifier |

OneBleKit is a device-function SDK. BIMENT is responsible for its integration, permission controls, and personal-information processing within the Apps. The current Apps do not request telephone, SMS-reading, or contacts permission and do not call such modules. Alipay is invoked only when you actively choose that payment method; the Kimi API is called by the server only after you actively submit community content. If an SDK, provider, purpose, or data scope changes materially, we will assess the change, update this policy, and obtain renewed consent where required.

7. Sharing, Transfer, and Public Disclosure

Except to complete a payment, delivery, verification message, or after-sales service that you request; with any separate consent required by law; to comply with a legal obligation; or as otherwise permitted by law, we do not provide personal information to third parties.

If a merger, division, restructuring, or asset transfer changes the controller, we will provide the notice required by law and require the recipient to continue to comply with this policy. Except for community content that you actively publish and that passes review, we do not publicly disclose your personal information unless otherwise required by law.

8. Storage Location and Retention

Business information is generally processed and stored on servers in the People's Republic of China. If you use an international account from outside mainland China, the information needed to provide the service is transmitted to and processed on those servers in China. We do not currently transfer personal information from those servers to a recipient outside China on our own initiative. If a future service requires such a transfer, we will complete the legally required assessment, notice, consent, and protection measures before it occurs.

Account and product information is retained until account deletion or for a reasonable period after the purpose has been fulfilled. Verification codes generally remain valid for five minutes. Community content is retained until deletion and for any additional period needed to resolve complaints or disputes. Transaction, payment, delivery, return, and after-sales information is retained for at least three years after completion of the transaction, or longer if applicable law requires it. Network-operation and security logs are generally retained for no less than six months. Backups are deleted on a rolling schedule.

At the end of an applicable period, we delete or anonymize the information. If continued retention is legally required or immediate deletion is not technically possible, we restrict processing to necessary storage and security protection.

9. Security

We use HTTPS encryption in transit, password and verification-code hashing, access controls, least-privilege administration, management-system isolation, upload validation, log redaction, backup recovery, and security auditing. Internet and Bluetooth environments cannot be absolutely secure. If personal information is or may be leaked, altered, or lost, we will take remedial action and notify users and authorities as required by law.

10. Your Rights and Choices

Where the relevant feature is available, you can use “Profile” or “My” to review and correct profile, contact, address, order, product, and after-sales information; delete saved addresses and community content that you are entitled to delete; unfollow or block another user; sign out; and request account deletion through “Profile → Account & Security → Delete Account” after identity verification.

You may also request permanent account deletion outside the App at https://www.biment.cn/en/account-deletion. Sign in with the account's verified email address, request a dedicated deletion code, and complete the confirmation steps shown on the page. If you cannot access the account, email service@biment.cn from the address associated with it; we will verify your identity before processing the request.

You may email service@biment.cn to request access, a copy, correction, completion, or deletion of personal information; an explanation of processing rules; withdrawal of consent; account deletion; or resolution of a complaint or appeal. We verify identity and respond within the period required by applicable law. Withdrawal does not affect processing that was lawful before withdrawal.

Android provides a “Withdraw Privacy Consent” action under “My”. It signs the user out and displays the consent screen again on the next launch. Clearing App data also causes the consent screen to be displayed again.

11. Children

The services are primarily intended for adults. A child under 14 must not independently register, purchase, or publish content. If use is necessary, a parent or legal guardian must read this policy and provide the consent required by law. If we learn that we processed a child's personal information without appropriate authorization, we will stop processing and delete or anonymize it as required by law.

12. Changes to This Policy

If a feature, permission, SDK, or processing rule changes materially, we will provide a prominent notice through an App prompt, page announcement, SMS, email, or another appropriate channel. Where applicable law requires renewed consent, we will update the accepted-policy version and obtain consent before initializing the affected service.

13. Contact Us

This English translation is provided so international users can understand the policy. If there is an inconsistency, the Chinese policy governs to the extent permitted by applicable law.