Privacy notice
Last updated 2026-10-14
This notice explains personal information processed when you browse Termbanks, use an account or workspace, publish terminology, or connect an agent. It distinguishes private working data, public contributions and external tools. It describes current product behavior; it does not claim that account deletion instantly erases every historical record or that all service providers process data only in one country.
Operator and contact
Termbanks is operated by Shanghai Xiaole Culture Media Co., Ltd., based in Shanghai, People's Republic of China. In these documents, “Termbanks”, “we” and “us” refer to this operator; “you” includes the person using the service and, where authorized, the organization they represent.
For service questions, privacy requests, security concerns, copyright notices, abuse reports or appeals, contact [email protected]. Describe the request and the affected account or public URL. Never send passwords, access tokens or unnecessary sensitive information. Signed-in users can also report public content through its Report action and review reports in Settings.
Account, profile and collaboration information
We process your email address, password hash, verification status, username, display name and the profile fields you choose, such as biography, website, working languages and avatar selection. We store workspace and collection memberships, roles, invitations and ownership information to manage collaboration and access.
Your password is stored as a hash, not as a readable password. Session and agent credential records include identifiers, scopes, selected collections, creation or expiry information and revocation status. Verification, reset, invitation and email-change workflows also process short-lived challenges and transactional email messages.
Public profile fields and activities may include a username, chosen name, biography, website, avatar, public collections, pins, public contribution statistics, milestones and public activity. Do not put private contact information in a field intended for public display. Your account email is not an ordinary public-profile field.
Content, requests and derived data
We process uploaded files, collections, terms, language tags, definitions, usage notes, sources, license and attribution information, edits, versions, comments, proposals, reports and review outcomes. Content can itself contain personal information; upload only what is necessary and permitted.
Search, lookup, translation-context, text-matching, import and export requests are processed to produce the response you ask for. Semantic search can generate embeddings from terms and definitions and temporary vectors from queries. Private query caches are scoped to the authorized user and workspace; hashes and vectors are derived data and should not be assumed anonymous simply because they are not the original text.
Operational records can include request identifiers, timestamps, credential and action identifiers, delivery attempts, job status and rate-limit counters. The server and security providers receive network and browser information such as IP addresses and user-agent information. Logs, reports, submitted content and backups can contain personal data; minimize sensitive text in requests and incident reports.
Purposes and processing grounds
We use information to create and secure accounts, provide storage and terminology workflows, enforce workspace permissions, process imports and exports, deliver transactional messages, support collaboration, review requested public contributions, investigate reports, maintain provenance, recover from incidents and meet applicable legal obligations.
Where applicable, processing grounds include your requested service or agreement, consent for activities that require it, and legal obligations or other grounds permitted by local law. Accepting the Terms is not consent to selling your data, unrelated marketing, unrestricted publication or every future processing purpose. We will seek separate consent or other required authorization for a material new purpose, sensitive-data processing or a transfer where law requires it.
Providing account and security information is necessary for account workflows. Optional profile fields and public contribution choices remain optional. Declining required security verification may prevent completion of the protected action, but does not make your private content public.
We do not sell personal information, serve behavioral advertising or use private content to train general-purpose AI models. Search indexing and inference are used to return results; user-connected tools may have different practices, described below.
Private access and operator access
Private collections are available to authorized workspace members, invited collaborators and scoped agent credentials. Access is checked by the service and database controls. Owners can change memberships and collection access; consider an organization's own policies before uploading employee or customer information.
Maintainers receive selected submitted contributions and report information needed for review, not unrestricted access to private workspaces through their reviewer role. Authorized operational personnel may need narrowly limited access for requested support, security response, recovery or lawful demands. Infrastructure operators can have technical access needed to operate their services; access controls are not a claim of end-to-end encryption.
Authorized recipients may make their own copies. Removing access or deleting your account does not remotely delete exports or data already received by collaborators or their tools. Ask those recipients about their own retention and privacy obligations.
Important — please read
Public contributions and public activity
Publication uses the separate owner-consent, selected-field, open-license and maintainer-review process. Selected public terminology, definitions, source notices and attribution may be visible through HTML pages, Markdown pages, public APIs, downloads, search engines and forks. Public discussions and public-profile activity are also visible according to the feature you use.
Public copies of reviewed terminology are separated from private workspace identifiers. This does not guarantee that source citations, attribution or free text contain no identifying information. Review them before submission and do not publish another person's personal information without the necessary permission or other lawful basis.
PUBLISHED MATERIAL CAN BE COPIED BY OTHERS. Public licenses can continue after account deletion or release withdrawal; search engines and third parties may keep copies. A valid copyright license does not waive another person's privacy rights or prevent a lawful privacy request. We can address material on our service within our control, but cannot guarantee removal of every external copy.
Important — please read
Agents, OAuth and external recipients
When you authorize an MCP client, personal access token or OAuth connection, the client can receive responses within its granted scope and your current permissions. These responses may contain private terms, definitions, source text, translation context, account or collection information and exports. External clients may also submit proposed edits for review.
The external agent, application or model provider is a separate recipient chosen by you. Its operator controls its own logging, retention, hosting locations and possible training practices. Our commitment not to train models on private content does not bind an independent tool. Check the tool's notice and your organization's requirements before granting access; use limited collections and revoke unused credentials.
Webhook destinations configured by authorized users receive the event payloads described by the integration. You are responsible for selecting a lawful recipient and securing its endpoint. Disconnecting a tool or webhook stops future authorized access or delivery; it does not retrieve data already delivered.
Service providers and human verification
Hosting, database, storage, backup and transactional email providers process information necessary for their services. Transactional mail includes a recipient address and the message or action link. Our current deployment uses a mainland-China VPS and Cloudflare for email services and Turnstile verification. Planned hosting or storage options in the repository are not a statement that they are all currently used.
Protected browser workflows load Cloudflare Turnstile. Cloudflare processes verification signals such as IP address, browser and TLS characteristics, user-agent, site key and origin, and returns a verification token. Our API sends that token and a client address to Cloudflare's verification service. Turnstile is used for abuse prevention, not to grant account privileges or publish content.
Cloudflare's own Turnstile Privacy Addendum explains its processing, purposes and retention. We do not send workspace documents, passwords or account email addresses as part of the Turnstile verification payload. The external script and network connection nevertheless expose verification-related browser information to Cloudflare.
We may disclose necessary information to advisers or authorities in response to valid legal requirements, to establish or defend rights, or to address serious security or safety incidents, subject to applicable safeguards. We do not treat a vague demand as unlimited authorization to release private workspace data.
Storage locations and international processing
The current application data is hosted on a mainland-China server. Cloudflare services, email networks and user-selected tools may process data in other locations. Public material may be accessed globally, and an external agent may transmit data to its own service locations. We do not promise that all processing stays in China or any other single jurisdiction.
Where a transfer or disclosure requires additional notice, a lawful transfer mechanism, assessment or separate consent, the operator must complete those requirements before relying on that processing. Merely accepting this notice does not waive them or establish that every possible international transfer is legally permitted. Use only approved tools and avoid restricted data.
Important — please read
Retention and account deletion
We retain information for the purposes described here and for applicable legal obligations, security, dispute resolution and recovery. Sessions, challenges, query caches and idempotency records have technical expiry or cleanup rules; expiry of permission to use a token is not necessarily immediate deletion of its audit record. We do not promise one universal retention period for all data categories.
Deleting your account removes or anonymizes key profile and authentication fields, revokes sessions and agent credentials, and ends memberships. Eligible personal collections are archived and pending candidates withdrawn. Shared organization content can remain for other authorized members, and deletion can be blocked until a sole owner hands over an organization with remaining members.
ACCOUNT DELETION IS NOT INSTANT DESTRUCTION OF EVERY COPY. Archived private terminology, edit history, provenance, reports, operational records and backups can remain until a separate lawful purge, expiry or anonymization process. The term graph is designed to preserve history; published material can remain under its open license. Account export contains credential metadata, never reusable credential secrets; terms must also be exported per collection.
We restrict retained personal information to necessary purposes. If law requires retention, or deletion is temporarily technically infeasible, further processing must be limited to permitted storage and protection rather than unrelated use. Backup copies may persist through their recovery lifecycle and must not be used to restore an erased account as an active user. Contact the operator for a request concerning residual personal information; the interface's account-deletion action alone is not a promise of a complete purge.
Your rights and choices
Depending on applicable law, you may request access or a copy, correction, deletion, explanation of processing, restriction or objection, and withdrawal of consent where consent is the basis. You may also raise a complaint with a competent regulator or use other statutory remedies. These terms do not require you to waive those rights.
Settings supports editing profile information, managing sessions and agent connections, viewing reports, exporting account information and deleting an account. Collection permissions and exports provide additional controls. Account export is not necessarily a complete response to every legal access request, so contact the operator for information the interface does not provide.
We may need proportionate verification of identity or authority to prevent disclosure to an impostor. Do not send a password or access token as proof. We will handle requests within applicable legal requirements, explain a lawful refusal or limitation, and avoid disclosing another person's information. Withdrawing a necessary permission can affect the corresponding service, without retrospectively invalidating lawful processing or valid open licenses.
Security and incident handling
We use measures such as HTTPS in the public deployment, password and token hashing, scoped credentials, workspace authorization and database row-level security, rate limits, CSRF protection and human verification. Authenticated and agent Markdown responses are marked private, no-store. These measures reduce risk but are not a guarantee against every breach or misuse.
Protect your devices, email account, passwords and action links; review connected tools and revoke suspicious credentials. Inform the operator promptly of a suspected incident using only the information needed to investigate. Where an incident triggers legal notification duties, we will provide the required information and take appropriate containment and remedial steps.
Children and sensitive information
Termbanks accounts are intended for adults aged 18 or over. We do not intentionally solicit children's personal information. If you believe a child has supplied account data, notify the operator so that it can be investigated and addressed under applicable law; no age-verification or parental-consent workflow is currently offered.
Do not upload highly sensitive or regulated information such as identity documents, payment-card data, patient records, biometrics or credentials. Remove identifying details from examples and source documents. If such information is inadvertently submitted, stop sharing it and contact the operator for assessment and appropriate handling.
Changes to this notice
The date above identifies this version. We will explain material changes to purposes, recipients or practices and provide any notice, choices or additional consent required by law. We will not treat this notice as permission to silently sell private data, introduce unrelated model training or expose private collections.
A separate signed agreement may describe additional obligations for a particular organization, but cannot remove mandatory data-subject rights. For questions or requests, use the operator's contact channel described at the beginning of this notice.