Applies to the OpenPartner official website, the online services, the account system, the plugins and model proxying provided by Sogood, and related enterprise services
OpenPartner supports enterprise on-premises deployment. With a fully local deployment and no external models, plugins, telemetry or Sogood-hosted services enabled, enterprise business content usually stays within the customer's own environment. If external models, third-party plugins, cloud services, Sogood-proxied models or operations support are enabled, the direction of data flow may change accordingly. The actual scope of processing depends on the specific deployment configuration, feature switches and the contract between the parties.
This Privacy Policy is formulated by Shenzhen Sogood Technology Co., Ltd. (hereinafter "Sogood" or "we"). It applies to our processing of personal information when you visit https://openpartner.sogood360.com/, or use the official OpenPartner online services, the account system, the proprietary plugins, model proxying, technical support, deployment and operations services, and any other service directly provided by Sogood.
Where an enterprise customer independently obtains the open-source code and deploys it entirely on its own, and independently determines the purposes and means of processing personal information, the enterprise customer is normally the personal information processor and bears the corresponding obligations. Where Sogood provides operations, migration, hosting or technical support solely on the enterprise customer's instructions and processes personal information as an entrusted party, we will perform the entrusted processing obligations in accordance with the contract between the parties and applicable law.
| Category of information | Possible contents | Primary purpose | Basis / scenario |
|---|---|---|---|
| Account and identity information | Name / nickname, mobile number or email, organization, department, role, login credentials, invitation relationships, etc. | Account registration, sign-in, security verification, organization management, permission assignment, customer support | Strictly necessary to provide the account and enterprise collaboration features; or based on your consent / contract performance |
| Device and log information | IP address, device / browser information, login time, operation logs, error logs, version numbers, node identifiers, etc. | Security auditing, troubleshooting, anti-abuse, performance optimization, service statistics | Ensuring network and service security, performing the contract, or necessary processing in accordance with law |
| User input and business content | Prompts, uploaded files, documents, images, video, templates, Skill configurations, MCP parameters, generated results, etc. | Fulfilling user requests, document parsing, RAG retrieval, content generation, plugin invocation, technical support | Processed only when actually required by the relevant service; in on-premises deployment mode, governed by the customer's configuration |
| Enterprise organization information | Organization name, departments, administrators, membership relationships, authorization scope, etc. | Enterprise organization management, collaboration, resource sharing and permission governance | Performance of the enterprise service contract |
| Model and plugin invocation information | Model type, invocation time, usage, request identifiers, plugin invocation records, necessary input and output information | Model routing, billing, quota management, troubleshooting, invocation auditing | Performance of the service contract and service security; where third parties are involved, handled per the third-party section of this policy |
| Transaction and invoicing information | Orders, packages, payment status, invoice title, tax number, contact person, etc. | Settlement, reconciliation, invoicing, financial compliance | Performance of the contract and statutory obligations |
| Customer service and feedback information | Tickets, communication records, issue descriptions, screenshots, contact details | Issue resolution, pre-sales and after-sales support, quality improvement | Performance of the contract, responding to requests, or provided voluntarily by you |
Fully on-premises deployment: where the customer deploys OpenPartner itself and enables no external services, Sogood will in principle not proactively collect business files, knowledge base content, prompts or generated results from the customer's local environment.
Operations and technical support: where the customer authorizes Sogood to provide remote operations, troubleshooting, data migration or technical support, we may access the necessary logs, configurations or business content within the authorized scope, and handle them in accordance with the agreement between the parties and the principle of minimum necessity.
Telemetry and error reporting: where the product provides telemetry, crash reporting or performance statistics features, the actual product configuration prevails. For optional telemetry, we will provide, as far as possible, a way to disable or configure it, and will avoid collecting business content unrelated to diagnostics.
Without separate and express authorization from the enterprise customer or the individual user, we will not use uploaded business content to train general-purpose models for other customers.
OpenPartner is an open platform, and users can proactively configure or invoke third-party large language models, plugins, MCP, cloud services, external data sources and external agents such as WorkBuddy. When you enable these capabilities, the relevant data may be sent to the corresponding third party according to your configuration.
Customers' own model accounts: data is processed directly according to the account configuration between the customer and the model vendor and the third party's rules; Sogood is generally not an independent provider of that third-party model service.
Sogood-proxied models: we may send the input necessary to complete a request to the corresponding model service provider, and manage third parties in accordance with the contract, the data processing agreement and applicable law.
Proprietary plugins and third-party components: some plugins may depend on open-source software, third-party commercial services or knowledge base products. The specific third parties and scope of data processing are determined by the features actually enabled, the plugin documentation and the third-party list.
External agents: when external agents such as WorkBuddy access OpenPartner capabilities through MCP, data may flow between the external agent and the customer's local OpenPartner environment; users should also review the external platform's privacy policy and data rules.
We recommend that the official website also maintain a "third-party SDK / service and sub-processor list", stating the name of each third party, the service type, the categories of information processed, the purpose of use, a link to the privacy policy and whether cross-border transfers may occur, so that enterprise customers can conduct their own review.
We do not run a business model based on selling personal information.
To provide model, cloud infrastructure, SMS / email, payment, customer support, security protection and other necessary services, we may entrust third parties to process part of your personal information. We will agree with the entrusted party on the purpose, duration, method, categories of information, protective measures and the rights and obligations of both parties in accordance with applicable law, and supervise their processing activities as necessary.
Where a merger, division, restructuring, asset transfer or other event results in a change of personal information processor, we will lawfully notify you of the name and contact details of the new processor, and require the successor to continue performing this policy or to re-obtain your consent in accordance with law.
Unless a lawful basis for processing is obtained or laws and regulations provide otherwise, we will not publicly disclose your personal information.
OpenPartner does not aim to collect sensitive personal information as its primary purpose. Because enterprise users may upload business documents, such content may include identity documents, financial accounts, precise location, health, biometric and minors' information.
Enterprise customers or uploaders should confirm before uploading that they have a lawful and sufficient basis for processing, and should follow the principles of purpose limitation, minimum necessity and access control.
Where Sogood directly determines the purposes and means of processing sensitive personal information, we will lawfully explain the necessity of processing and its impact on personal rights and interests, and obtain separate consent where required by law.
We retain personal information for the shortest period necessary to achieve the purposes described in this policy, unless laws and regulations, regulatory requirements or dispute handling provide otherwise.
After an account is closed or the service is terminated, we will delete or anonymize personal information that is no longer needed within the period required by law and the necessary technical cycle; data in backup systems may be cleared after the backup rotation cycle ends.
Retention periods for business data in on-premises deployment environments are generally determined and managed by the enterprise customer itself.
Where applicable AI-generated synthetic content labelling rules require that logs recording the recipients of specific content exported without an explicit label be retained, we will retain the relevant logs for the period prescribed by law.
We prioritize enterprise on-premises deployment and model / service configurations that customers can choose independently. If you actively choose overseas models, overseas cloud services, overseas plugins or other features that may result in personal information leaving the country, we will take appropriate measures according to the specific role and legal requirements.
Where required by law, we will lawfully perform notification, obtain separate consent, conduct a personal information protection impact assessment, and take measures such as security assessment, the standard contract for cross-border transfer of personal information, personal information protection certification or other statutory mechanisms, as applicable.
Where an enterprise customer independently selects an overseas third party and independently determines the purpose and means of the cross-border transfer, it should assess and fulfil its statutory obligations as a personal information processor.
If you do not wish cross-border transfers to occur, you can prioritize domestic models, domestic deployment and local plugin capabilities.
The official website may use cookies, local storage or similar technologies to maintain sign-in state, support security verification, save necessary preferences and ensure the website operates normally. If we use non-essential statistical, analytical or marketing cookies / SDKs, we will provide the corresponding notice, settings or consent mechanism in accordance with applicable law.
Essential technologies: used for sign-in, security, sessions, load balancing, language / interface preferences and similar purposes.
Analytical technologies: where enabled, used to understand website visits and product usage and help improve the service; the specifics depend on the tools actually integrated and the page descriptions.
We adopt access control, identity authentication, separation of duties, transmission protection, log auditing, backup, vulnerability management and security update measures proportionate to the risk.
We set necessary permission boundaries and confidentiality requirements for enterprise administrators, operations personnel and entrusted processors.
We maintain a data security incident response mechanism; where personal information is leaked, tampered with or lost, or may be, we will take remedial measures in accordance with law and fulfil notification and reporting obligations.
For third-party suppliers, we adopt contractual constraints, permission restrictions, compliance reviews or other appropriate management measures according to the nature and risk of the service.
Under applicable law, you may exercise the following rights:
For enterprise accounts, some requests may need to be handled through your enterprise administrator or according to the service relationship between your enterprise and Sogood. We will respond in accordance with law after verifying the identity of the requester.
OpenPartner is primarily intended for enterprises and professional users, and we do not target minors under the age of fourteen as a primary service audience. Where the personal information of minors under fourteen must indeed be processed, we will obtain the consent of their parents or other guardians in accordance with law and establish or apply dedicated rules for the processing of such personal information.
We may update this policy due to changes in laws and regulations, product features, deployment models, third-party services or the business model. For changes that materially affect the rules on processing personal information, we will provide notice through the website, the product interface or other reasonable means, and re-obtain your consent where required by law.
Personal information processor / operator: Shenzhen Sogood Technology Co., Ltd.
Official website: https://openpartner.sogood360.com/
Telephone: 0755-86952335
You may submit requests concerning your personal information rights, privacy complaints, data security issues or other enquiries through the methods published on the "Contact us" page of the official website. We will handle them within the period prescribed by applicable law after verifying your identity and the content of the request.
This policy was drafted with reference to, among others, the Personal Information Protection Law of the People's Republic of China, the Cybersecurity Law of the People's Republic of China, the Data Security Law of the People's Republic of China, the Regulations on the Security Management of Network Data, the Interim Measures for the Administration of Generative Artificial Intelligence Services and the Measures for Labelling AI-Generated Synthetic Content, together with other applicable laws, administrative regulations and mandatory national standards.
