APP PRIVACY POLICY

Evolve Hospitality Privacy Policy

Business-essential processing, controlled access and traceable actions for employee accounts, hotel operations and in-app messages.

Effective and updated: 2 November 2026Applies to the iOS, Android and HarmonyOS apps

This policy explains how Fenglan Xingchen (shanghai) Artificial Intelligence Technology Co., Ltd ("we" or "us") handles personal information when providing the Evolve Hospitality mobile apps (易服智能; the current English app display name is Easyserve), and how you can exercise your rights. Please read this policy before using the app.

01

Scope and processing roles

This policy applies to the iOS, Android and HarmonyOS apps, a customer service, work order and operations collaboration tool for employees authorized by hotels or other enterprises. Public self-registration is not available.

We process information needed to provide employee accounts, secure operations and technical support. For guests, channel customers, reservations, chats, work orders and housekeeping information, your hotel or enterprise generally determines the purposes and access permissions. We provide technical services under its authorization and instructions. You should also read and follow your organization's internal privacy and data-use rules.

02

Information we process

Employee accounts and permissions

Account identifiers, names, telephone numbers, profile images, hotel or enterprise affiliation, roles, menu permissions, work order groups, and sign-in and session authentication information. Enterprise administrators create, configure and deactivate accounts.

Hotel business and customer service

Depending on enabled features, this may include guest or channel-customer names, contact details, profile images, reservations and stay information, room numbers, service preferences, identity-verification information, chat text and images, work orders, attachments, processing statuses and action records. The actual scope depends on enterprise configuration and your access permissions.

Devices and operation

To maintain sessions, protect security and troubleshoot problems, we may process device platform and version, network addresses, sign-in times, action logs and errors. Some earlier versions do not provide system push; versions that support push may, after you consent and allow notifications, process Apple or device-vendor push tokens, JPush registration identifiers, device, system and network information and delivery records to associate a device with your current account and organization and deliver notifications. Notifications may contain customer message or work order previews. We do not separately retain in-app search history long term.

Support requests

When you contact us, we process information you choose to provide, including your name, contact details, organization, issue description, screenshots and necessary diagnostics. Redact guest personal information unrelated to the issue before submitting it.

03

Purposes of processing

  • Verify employee identity, restore sessions and control access by role and organization.
  • Display and process authorized chats, work orders, reservations, housekeeping and operational information.
  • Connect customer service channels, hotel systems, messaging services and business tools configured by your organization.
  • Display authorized chats, work orders and system messages in the app and, if enabled, deliver customer message and work order notifications to authorized devices in the current organization.
  • Troubleshoot problems, prevent abuse and protect accounts, networks and services.
  • Respond to support, access, correction, deactivation or deletion requests.
  • Meet applicable legal, regulatory or dispute-resolution obligations.

We do not use this information for advertising profiles or transactions unrelated to your organization's authorized purposes.

04

Sharing, service providers and AI permission

We do not sell personal information. Where necessary for a feature, appropriately authorized or permitted by law, the following recipients may access necessary information:

  • Your hotel or enterprise: administrators manage accounts, roles, business records and permissions.
  • Configured business systems or channels: customer service channels, hotel systems, work order or image services receive only information needed for the corresponding action.
  • JPush SDK for iOS: includes JPush 6.3.0 and JCore 5.6.0 (no-IDFA build), provided by Shenzhen Hexun Huagu Information Technology Co., Ltd. After you consent and enable push, the SDK collects push identifiers and necessary device, system and network information and delivery records to provide notifications. Our server also submits the target device identifier and notification content, which may include customer message or work order previews, to JPush. JPush uses Apple Push Notification service (APNs) to deliver to the device. Actual processing depends on the system and enabled features. See the Jiguang privacy policy and JPush compliance guide.
  • JPush SDK for Android and HarmonyOS: provided by Shenzhen Hexun Huagu Information Technology Co., Ltd. for optional work notifications. The SDK processes push registration and device identifiers (such as Android ID, OAID and AAID), device model and manufacturer, system version and language, network type, operator, IP address and push logs; our server submits target device identifiers and notification content to JPush. Actual processing depends on the system, SDK version and enabled functions. See the Jiguang privacy policy and compliance guide.
  • Huawei Push: provided by Huawei Software Technologies Co., Ltd. to deliver notifications on supported Huawei devices. It may process app, device, system and network information and push identifiers. See the Huawei data security information.
  • Xiaomi Push SDK: where the installed version integrates and enables the Xiaomi channel, Beijing Xiaomi Mobile Software Co., Ltd. provides notification delivery on Xiaomi devices. It may process device, system and network information, notification settings and message content. See the Xiaomi Push privacy policy.
  • Alibaba Cloud Bailian (Model Studio): for enabled AI functions, our enterprise backend uses a China service region. Depending on the feature and enterprise configuration, necessary questions, relevant conversation excerpts, images or knowledge-document content may be processed for retrieval, answer generation or skill generation. The platform's current public service agreement names 通义云启(杭州)信息技术有限公司 as its provider. Submit only work-related content you are authorized to share, not unrelated personal information, identity documents or confidential materials. See Bailian's privacy notice and service agreement.
  • Infrastructure and security providers: necessary hosting, transmission, storage, backup and security services.

Before sharing personal information with third-party AI, the recipient, purpose and necessary data scope must be disclosed and the required explicit permission obtained. App versions supporting per-action confirmation offer confirmation and cancellation before knowledge uploads, reindexing, Q&A and Q&A-to-skill actions; cancellation prevents that request. An employee's confirmation does not replace guest authorization or stop other business channels or backend automation. Direct requests concerning already processed data or other channels to your enterprise administrator or our official email.

If a merger, division, acquisition or asset transfer requires transferring information, we will require the recipient to remain bound by this policy and provide notice or obtain consent as required by law. We do not publicly disclose personal information unless legally required, necessary to protect significant legitimate interests or authorized.

05

Retention, location and security

Business data is retained for the period agreed with each enterprise customer, subject to applicable legal requirements. Ask your administrator for your organization's retention period. Account deactivation does not automatically delete enterprise business records. At the end of the agreed period, deletion, anonymization or legally required retention is handled under the agreement and applicable law.

The enterprise retention period does not establish zero retention by Bailian. Bailian stores model and application invocation data as required by law. Provider records and cloud logs are governed by applicable service terms, settings and retention rules, separately from our business database. We do not promise immediate deletion of all backups.

Push registrations are used while the service is enabled. When you sign out, switch organizations or withdraw push consent, we attempt to deactivate the registration and retry later if offline or unsuccessful. A notification preview may be encrypted in the pending delivery queue for retries and is removed from the task on success or cancellation. Backups and provider records may remain under their own rules; contact your organization or us for details. Jiguang's processing and retention are described in its privacy policy. Notifications already submitted to a provider cannot necessarily be recalled immediately.

Security measures include encrypted transmission, platform secure storage, role- and organization-based access controls, sensitive-information masking and action logs. No system can guarantee absolute security. If an incident may affect your rights, we will take response and notification measures required by law.

If processing involves international transfers, we will complete the assessments, notices, authorizations or other compliance procedures required by applicable law.

06

Your rights and choices

To the extent provided by applicable law, you may request access, copies, correction, supplementation, restriction or deletion of your information, and withdraw consent for processing based on consent.

  • Accounts and roles: contact your enterprise administrator first. Accounts are enterprise-created, not publicly self-registered. Administrators deactivate or delete accounts when employees leave, change roles or stop using the service.
  • Guest and business data: contact the hotel or enterprise determining the processing purposes. We provide technical assistance after verifying its authorization.
  • Notifications: in versions supporting push, use More → Message Notifications to enable, disable or withdraw push consent and choose whether to send message and work order previews. Without preview consent, only generic alerts are sent. You can also disable notifications in your device settings. Adjust system notification settings to hide previews when locked; on iPhone, select When Unlocked. In-app chats and work orders remain available without push.
  • Privacy requests: email info@vastbluestarry.ai. To protect accounts and enterprise data, we may verify your identity, organization and authority to make the request.
07

Minors

The app is a business tool for enterprise-authorized employees. It does not offer services to minors or target minors when creating accounts. Contact us if you discover a minor's information submitted without appropriate authorization.

08

Updates and contact

We may update this policy when features, processing practices or applicable laws change. Material changes will be communicated through the app, website or a channel accessible through your organization, and the page will show the updated date.

Fenglan Xingchen (shanghai) Artificial Intelligence Technology Co., LtdEmail: info@vastbluestarry.aiRoom 339, Building 1, No. 1999 Shenhong Road, Minhang District, Shanghai, China