Privacy Policy and Terms of Service

1. Introduction and Scope

WorksBase is a global CNC creation and manufacturing community platform operated by NestWorks. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you visit WorksBase.com, use the WorksBase website, mobile application, or related community services.

WorksBase provides services to users worldwide, including but not limited to users in North America, Europe, Southeast Asia, and other countries and regions. Because privacy laws may vary across regions, this Policy also explains supplemental rights applicable to users in specific jurisdictions, including certain U.S. states, the European Union / United Kingdom, Canada, and other applicable regions.

By using the WorksBase services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this Policy, please stop using our services.

2. Information We Collect

We collect the following types of information depending on how you use the WorksBase services. We process such information only to the extent necessary to provide the services, perform a contract, comply with legal obligations, protect platform security, or with your consent.

2.1 Information You Provide: When you register an account, create a profile, publish content, participate in community interactions, contact customer support, or use platform features, you may provide us with:

• Account information: username, email address, password, or other login credentials.
• Profile information: avatar, personal bio, region, device preferences, creative disciplines, and other information that you voluntarily provide.
• User-generated content: CAD drawings, G-code files, project images, videos, project descriptions, comments, favorites, likes, following relationships, private messages, or other community interaction content that you upload, publish, or submit.
• Points and rewards data: your community points balance, points earning records (new user tasks, daily tasks, content quality rewards, community interaction rewards), points spending records (rewards store redemptions, cash withdrawal applications), points freezing and unfreezing records, redemption review status, points expiration records, and anomalous activity flags generated by our rewards integrity controls.
• Transaction and service information: if WorksBase provides inquiry, quotation, order, payment, redemption, or manufacturing service features, we may collect information related to transaction fulfillment, risk control, customer support, and compliance, including but not limited to redeemed product information, withdrawal amount and receiving account information, order status, and logistics information.
• Tax-related information: when you apply to redeem points for cash (withdrawal), we may collect necessary tax identity information under applicable laws (such as U.S. IRS requirements), including but not limited to tax forms (such as W-9 and W-8BEN) and related taxpayer identification numbers.
• Communication information: questions, complaints, appeals, surveys, or other communications that you submit to customer support, operations personnel, or platform feedback channels.

2.2 Information We Collect Automatically: When you access or use the WorksBase services, we may automatically collect:

• Device and log information: IP address, browser type, operating system, device identifiers, access time, page views, clickstream data, error logs, crash logs, and similar information.
• Usage behavior information: search, browsing, downloads, likes, favorites, comments, follows, posts, reports, shares, page dwell time, and other in-service operation records.
• Cookie and similar technology information: we may use cookies, pixel tags, local storage, or similar technologies to identify your device, remember preferences, analyze traffic, improve security, and enhance user experience.
• Location information: with your authorization or where permitted by applicable law, we may infer your approximate region based on your IP address, or request more precise location permissions when required for specific features.

2.3 Information from Third Parties: In applicable scenarios, we may obtain information from the following sources:

• Third-party login services: when you choose to log in using Google, Facebook, or another third-party account, we may receive basic information necessary to complete login and account binding based on your authorization, such as public name, avatar, and email address.
• Payment, risk control, data analytics, and customer support providers: when providing payment, anti-fraud, security detection, data analytics, or customer support, relevant providers may provide us with necessary information.
• Public sources or partners: to the extent permitted by law, we may obtain supplemental information from public sources or compliant partners for security, compliance, anti-fraud, or enforcement purposes.

3. How We Use Your Information

We may process your information for the following purposes:

• To provide, operate, maintain, and improve the WorksBase services.
• To create and manage your account and verify your identity.
• To support project publishing, content browsing, comments, favorites, likes, follows, private messages, downloads, and other community interaction features.
• To support inquiry, quotation, order, payment, redemption, manufacturing services, or other platform transaction features.
• To send you service notices, account security alerts, review results, transaction notices, customer support responses, and other necessary communications.
• To conduct data analytics, product research, user experience optimization, and service quality improvement.
• To provide, operate, and improve AI Lab features, including generating 3D models, design proposals, or other AI-assisted content based on user-submitted text, images, or other materials. We will not use your user content to train third-party AI models unless we obtain your explicit consent.
• To identify, prevent, and address fraud, abuse, violating content, security incidents, or other illegal activities.
• To protect the legitimate rights and interests of WorksBase, NestWorks, users, and third parties.
• To comply with applicable laws and regulations, judicial proceedings, regulatory requirements, or lawful requests from government authorities.
• For marketing, event notifications, personalized recommendations, or advertising-related purposes where permitted by law and with your consent.

4. How We Share and Disclose Your Information

We will not disclose your personal information to third parties except as described in this Policy or with your authorization. We may share or disclose information in the following circumstances:

• Service providers: with third parties that are contractually bound and process information on our behalf, such as cloud storage, content delivery, payment processing, data analytics, customer support, security and risk control, email delivery, and marketing service providers.
• Parties related to transactions or manufacturing services: when you use in-platform inquiry, quotation, order, payment, fulfillment, or manufacturing service features, we may share necessary information with relevant parties to the extent required for transaction completion, fulfillment, after-sales service, dispute handling, and compliance.
• Legal and compliance requirements: to comply with legal obligations, respond to valid legal process, cooperate with regulatory or law enforcement requests, or protect the rights, property, and safety of us, users, third parties, and the public.
• Business transfers: in transactions involving mergers, acquisitions, asset sales, financing, restructuring, or bankruptcy, your information may be transferred as part of business assets, but we will require the recipient to continue complying with protection requirements no less protective than this Policy.
• With your consent: for other disclosures with your explicit consent or at your active request.

For "sale" or "sharing" of personal information as defined under applicable law, we will provide corresponding disclosures and opt-out mechanisms in accordance with local laws.

5. Cookies and Tracking Technologies

We use cookies, pixel tags, local storage, and similar technologies to identify your device, remember your preferences, keep you logged in, analyze service usage, improve security, optimize product experience, and provide personalized content or advertising where permitted by applicable law and with your consent.

You can manage or delete cookies through your browser settings. Users in certain regions may also use cookie preference management tools to accept or reject non-essential cookies. Disabling certain cookies may affect some WorksBase features.

If required by applicable law, we will provide opt-out methods for targeted advertising, cross-context behavioral advertising, and the "sale" or "sharing" of personal information, and will identify and respond to applicable browser privacy signals to the extent required by applicable law.

6. User Privacy Rights

Depending on the laws applicable in your country or region, you may have one or more of the following rights:

• Right of access: to request whether we process your personal information and obtain a copy of relevant information.
• Right to correction: to request correction of inaccurate or incomplete personal information.
• Right to deletion: to request deletion of your personal information, except where retention is required by law or necessary for business purposes.
• Right to withdraw consent: for information processed based on your consent, you may withdraw consent at any time.
• Right to restriction of processing: to request that we restrict processing of your personal information in specific circumstances.
• Right to data portability: to request your personal information in a structured and commonly used format to the extent permitted by applicable law.
• Right to object: to object in specific circumstances to data processing based on our legitimate interests.
• Right to opt out: to opt out of targeted advertising, cross-context behavioral advertising, and the "sale" or "sharing" of personal information as defined under applicable law.
• Right to non-discrimination: exercising your privacy rights in accordance with law will not result in unreasonable differential treatment or service degradation.

For users in California, Virginia, Colorado, and other U.S. regions, we will handle your requests in accordance with applicable state privacy laws. For users in the European Union, the United Kingdom, and other applicable regions, we will handle your requests under the GDPR, UK GDPR, or applicable local data protection laws. For users in Canada and other regions, we will process your access, correction, consent withdrawal, and complaint requests in accordance with applicable local privacy laws.

You may contact us at WorksBase@nestworks.ai to exercise relevant rights. To protect account security, we may need you to provide necessary information to verify your identity. We will respond to your request within the time limit required by applicable law.

7. Data Retention

We will retain your personal information only for as long as necessary to achieve the purposes described in this Policy, or as required to comply with legal obligations, resolve disputes, prevent fraud, ensure security, enforce agreements, and protect legitimate rights and interests.

Retention periods may vary for different types of information. For example, account information is generally retained for the duration of the account; transaction, payment, risk control, compliance, and security logs may be retained for a longer period according to legal requirements or business needs; after you delete or close your account, some information may continue to be retained for a reasonable period in backup systems, audit records, or as required by law.

8. Data Security

We take reasonable technical and organizational measures to protect your information, including access control, encrypted transmission, permission management, log auditing, security monitoring, and vendor management.

However, no internet transmission or electronic storage method can guarantee absolute security. You should also properly safeguard your account credentials and avoid uploading, downloading, or sharing sensitive project files in insecure environments.

9. International Data Transfers

WorksBase is operated by NestWorks in Shenzhen, China. Because we provide services to users worldwide, your personal information may be accessed, processed, or stored outside your country or region, including in China and in countries or regions where our cloud service, data analytics, customer support, security service, and other partner providers are located.

When cross-border data transfers occur, we will take reasonable safeguards in accordance with applicable law, such as signing data processing agreements, adopting contractual protection clauses, restricting access permissions, and encrypting transmission and storage, to protect the security of your personal information.

10. Children's Privacy

The WorksBase services are not directed to children under the age of 13, or to children under the higher digital age of consent required by applicable law. If you have not reached the minimum age required in your country or region, please do not use the WorksBase services.

If we discover that we have unintentionally collected personal information from a child, we will delete the relevant information within a reasonable period. Parents or guardians who believe that a child has provided personal information to us may contact us at WorksBase@nestworks.ai.

11. Policy Changes

We may update this Privacy Policy from time to time. For material changes, we will notify you through website announcements, in-app notices, email, or other reasonable means. The updated Policy will indicate the effective date on the page.

By continuing to use the WorksBase services after changes take effect, you acknowledge that you have read and understood the updated Privacy Policy.

12. Contact Us

If you have any questions about this Privacy Policy, wish to exercise privacy rights, or wish to make a complaint, please contact us through the following methods:

Operator: NestWorks

Service name: WorksBase

Email: WorksBase@nestworks.ai

Website: WorksBase.com

Mailing address: Room 618, Building D, Zhi Fang Zhou Hardware Innovation Center, Huaqiangbei, Futian District, Shenzhen, Guangdong Province, China

1. Acceptance of Terms

Welcome to WorksBase. WorksBase is a global CNC creation and manufacturing community platform operated by NestWorks. By accessing or using the WorksBase website, mobile application, or related services, you agree to be bound by these Terms of Service and our Privacy Policy.

If you do not agree to these Terms, please do not use the WorksBase services. If you use WorksBase on behalf of a company, institution, or other organization, you represent and warrant that you have authority to accept these Terms on behalf of that organization.

You confirm that you are at least 13 years old, or have reached the minimum digital age of consent required by the laws of your country or region. If you do not meet the applicable age requirement, please do not use the WorksBase services.

2. Account Responsibilities

Account security: you are responsible for maintaining the confidentiality of your account credentials and for all activities that occur under your account.

Accurate information: you should provide accurate, complete, and truthful registration information, and update it promptly when it changes.

Unauthorized use: if you discover unauthorized account use, password leakage, or other security risks, you should notify us promptly

Account termination: you may close your account through account settings or by contacting us. If you violate these Terms, laws and regulations, or community rules, we reserve the right to suspend, restrict, or terminate your access to the WorksBase services.

3. User Conduct and Content Standards

You agree that you will not use the WorksBase services to engage in the following activities:

• Violating any applicable laws, regulations, or regulatory requirements.
• Infringing another person's intellectual property rights, privacy rights, publicity rights, trade secrets, or other legitimate rights and interests.
• Posting illegal, fraudulent, defamatory, obscene, harassing, hateful, threatening, violent, or discriminatory content.
• Uploading or transmitting viruses or malicious code, or taking actions that may interfere with the WorksBase services, servers, networks, or security systems.
• Collecting, scraping, storing, or misusing other users' information without authorization.
• Impersonating another person, organization, or NestWorks / WorksBase employee.
• Circumventing, undermining, or interfering with the platform's content review, risk control, security, anti-fraud, or access restriction mechanisms.
• Posting advertisements, spam, traffic diversion content, or commercial promotional content without authorization, except for commercial features expressly permitted by the platform.
• Uploading or transmitting hazardous manufacturing files, parameters, or instructions that may cause equipment damage, personal injury, illegal manufacturing, or other high-risk consequences.

4. User-Generated Content

You retain all rights to the content you upload, publish, or submit to WorksBase, including but not limited to CAD drawings, G-code files, project images, videos, text descriptions, comments, and other project materials.

To operate, display, distribute, promote, and improve the WorksBase services, you grant NestWorks a worldwide, non-exclusive, royalty-free, sublicensable license to host, store, reproduce, display, transmit, adapt, and process your user content to the extent necessary.

The above license is limited to the scope necessary to provide and improve the WorksBase services. For drafts, private files, or non-public content in your account that you have not publicly published, we will not use them for public display or external promotion unless we obtain your explicit authorization or are otherwise required by law.

You represent and warrant that you have all rights necessary to submit the relevant user content, and that the content does not infringe any third party's intellectual property rights, privacy rights, trade secrets, or other legitimate rights and interests.

We do not actively undertake to monitor all user content, but reserve the right, to the extent permitted by law, to review, edit, reject publication of, restrict distribution of, remove, or delete user content, including but not limited to content that we believe violates these Terms, community rules, laws and regulations, platform security requirements, or third-party rights.

5. Intellectual Property

The WorksBase services themselves, including but not limited to website architecture, interface design, software code, brand marks, text, images, videos, feature design, and data organization methods, are owned by NestWorks or its licensors and are protected by copyright, trademark, and other applicable laws.

Unless expressly permitted by these Terms, you may not copy, modify, distribute, sell, rent, reverse engineer, or otherwise use any part of the WorksBase services without authorization.

The WorksBase name, marks, domain name, page design, and related brand assets are owned by NestWorks or its licensors. Without written permission, you may not use the above brand assets in a manner that may cause confusion, mislead others, or imply a cooperative relationship.

Copyright Infringement Notice (DMCA): NestWorks respects intellectual property rights and expects users to do the same. If you believe that content on WorksBase infringes your copyright, you may submit a written notice to us at WorksBase@nestworks.ai with the following information:

• (a) A description of the copyrighted work you claim has been infringed;
• (b) A description of where the allegedly infringing material is located on WorksBase, with sufficient detail for us to locate it;
• (c) Your contact information (name, address, telephone number, and email address);
• (d) A statement that you have a good-faith belief that the disputed use is not authorized by the copyright owner, its agent, or the law;
• (e) A statement, made under penalty of perjury, that the information in your notice is accurate and that you are the copyright owner or authorized to act on the copyright owner's behalf.

Upon receiving a valid notice, we will investigate and take appropriate action, which may include removing or disabling access to the allegedly infringing content. Repeat infringers may have their accounts terminated. If you believe your content was removed in error, you may submit a counter-notice to WorksBase@nestworks.ai.

6. CNC Content and Manufacturing Risk Disclaimer

WorksBase is a platform for CNC creation, project sharing, and community communication. CAD drawings, G-code, manufacturing parameters, material recommendations, or project descriptions uploaded by users are provided by users themselves. NestWorks does not guarantee the accuracy, safety, manufacturability, device compatibility, or fitness for a particular purpose of any user content.

Before downloading, using, manufacturing, or adapting any user content, you should independently assess its safety and suitability, and comply with equipment manufacturer instructions, material safety specifications, and local laws and regulations. Except as otherwise provided by law, the user of such content bears the corresponding risks for equipment damage, material loss, personal injury, or other damages caused by use of user content.

For content involving hazardous materials, controlled items, weapons, circumvention of safety mechanisms, or other content that may violate laws and regulations, WorksBase has the right to restrict, remove, delete, or report such content to relevant authorities in accordance with platform rules.

7. Transactions, Manufacturing Services, and Third-Party Interactions

If WorksBase provides inquiry, quotation, order, payment, redemption, manufacturing service, or third-party service entry features, the relevant transactions may be subject to additional rules, order terms, refund policies, service descriptions, or third-party terms.

Communications, transactions, fulfillment, or disputes between you and other users, manufacturing service providers, payment institutions, logistics providers, or other third parties through WorksBase are, in principle, the responsibility of the transaction-related parties themselves. NestWorks only provides necessary platform support, record retention, dispute assistance, and risk control handling within the scope permitted by platform rules and applicable law.

If a service is provided directly by a third party, we are not responsible for the quality, safety, legality, availability, or content of the third-party service beyond the scope required by law.

8. Force Majeure

NestWorks will not be liable for any failure or delay in the performance of its obligations under these Terms to the extent that such failure or delay is caused by circumstances beyond its reasonable control, including but not limited to acts of God, natural disasters, epidemic or pandemic events, war, civil unrest, government actions, internet or telecommunications outages, cyberattacks, or third-party service failures. NestWorks will make reasonable efforts to resume affected services as soon as practicable and will notify users of significant service disruptions through the WorksBase website, in-app notices, or other available channels.

9. Disclaimers and Limitation of Liability

The WorksBase services are provided on an "as is" and "as available" basis. To the maximum extent permitted by law, NestWorks makes no express or implied warranties regarding the continuous availability, error-free operation, complete security, fitness for a particular purpose, or accuracy of user content of the services.

To the maximum extent permitted by law, NestWorks and its affiliates, directors, employees, and agents shall not be liable for indirect, incidental, special, punitive, consequential damages, or loss of profits arising from the use of or inability to use the WorksBase services, user content, third-party services, or platform interactions.

The limitation of liability in these Terms does not exclude or limit liabilities that cannot be excluded or limited under applicable law, including non-excludable liabilities arising from willful misconduct, gross negligence, fraud, or applicable consumer protection laws.

10. Indemnification

If any claims, losses, liabilities, costs, or expenses arise from your violation of these Terms, misuse of the WorksBase services, submission of infringing or illegal content, infringement of third-party rights, or violation of applicable laws and regulations, you agree, to the extent permitted by law, to indemnify and hold harmless NestWorks and its affiliates, officers, directors, employees, and agents, including reasonable attorneys' fees and rights enforcement costs.

11. Governing Law and Dispute Resolution

The formation, interpretation, performance, and dispute resolution of these Terms shall be governed by the laws of the People's Republic of China, excluding its conflict of law rules. If mandatory consumer protection laws in your country or region provide otherwise, such mandatory provisions shall not be affected by these Terms.

Any dispute arising from these Terms or the WorksBase services shall first be resolved through friendly consultation between the parties; if consultation fails, either party may submit the dispute to the people's court with jurisdiction at the location of NestWorks, or the parties may separately agree in writing to resolve the dispute through arbitration.

12. Severability and Changes to Terms

If any provision of these Terms is held invalid, illegal, or unenforceable, that provision shall be modified or interpreted to the minimum extent necessary to make it enforceable under applicable law; the remaining provisions shall remain in full force and effect.

We may modify these Terms from time to time. For material changes, we will notify you through website announcements, in-app notices, email, or other reasonable means. The updated Terms will indicate the effective date on the page.

By continuing to use the WorksBase services after changes take effect, you accept the updated Terms of Service.

13. Contact Us

If you have any questions about these Terms of Service, please contact us through the following methods:

Operator: NestWorks

Service name: WorksBase

Email: WorksBase@nestworks.ai

Website: WorksBase.com

Mailing address: Room 618, Building D, Zhi Fang Zhou Hardware Innovation Center, Huaqiangbei, Futian District, Shenzhen, Guangdong Province, China

1. Overview

This section supplements the privacy rights available to users in specific regions under applicable law. If there is any inconsistency between this section and the preceding sections, and applicable law requires a higher standard of protection, the requirements of the applicable regional law shall prevail.

2. Supplemental Terms for EU / UK Users

If you are located in the European Economic Area, a member state of the European Union, or the United Kingdom, we will process your personal information in accordance with the GDPR, UK GDPR, and other applicable data protection laws.

2.1 Data Controller: For the processing of personal information in the WorksBase services, NestWorks generally acts as the data controller that determines the purposes and means of processing personal information. You may contact us at WorksBase@nestworks.ai to learn about or exercise your data protection rights.

2.2 Legal Bases for Processing Personal Information: We may process your personal information based on one or more of the following legal bases:

• Performance of a contract: necessary to create accounts, provide community features, process transactions, provide customer support, and perform the WorksBase Terms of Service.
• User consent: we will request your consent when sending marketing communications, using non-essential cookies, processing certain sensitive information, or in scenarios where applicable law requires consent.
• Legitimate interests: used to ensure platform security, prevent fraud, improve products, conduct basic data analytics, maintain community order, and protect legitimate rights and interests, while balancing such interests against your fundamental rights and freedoms.
• Compliance with legal obligations: used to respond to regulatory, judicial, tax, accounting, consumer protection, data protection, or other applicable legal requirements.
• Protection of vital interests: where necessary, used to protect your or another person's life, physical safety, or major public interests.

2.3 Your Rights: Within the scope of applicable law, you may request to:

• Access the personal information about you that we process.
• Correct inaccurate or incomplete personal information.
• Delete your personal information.
• Restrict our processing of your personal information.
• Object to processing based on legitimate interests or direct marketing purposes.
• Obtain a copy of your data in a structured, commonly used, machine-readable format, and request data portability where applicable.
• Withdraw your previously given consent, without affecting the lawfulness of processing based on consent before withdrawal.
• Lodge a complaint with the data protection supervisory authority in your region.

2.4 Cross-Border Data Transfers: Because NestWorks is located in Shenzhen, China, and WorksBase may use service providers located in different countries or regions, your personal information may be transferred to areas outside the European Economic Area, the United Kingdom, or your country. When required by applicable law, we will take appropriate safeguards, such as signing Standard Contractual Clauses, data processing agreements, access restrictions, encryption, data minimization, and vendor security reviews, to protect personal information during cross-border transfers.

2.5 Data Protection Contact: If you have questions about EU / UK data protection matters or wish to exercise relevant rights, you may contact us at WorksBase@nestworks.ai. Under Article 27 of the GDPR, because NestWorks is not registered in the European Economic Area, before formally providing commercial services to EU / UK users, we will designate a written representative in the European Union and supplement this Policy with that representative's name and contact information. If applicable law in the future requires designation of a UK representative, data protection officer, or local contact, WorksBase will supplement this Policy with the relevant information.

3. Supplemental Terms for California Users

If you are a resident of California, United States, this section supplements how we collect, use, disclose, and protect your personal information under the CCPA / CPRA and other applicable California privacy laws.

3.1 Categories of Personal Information We May Collect: In the past 12 months, depending on the features you actually used, we may have collected the following categories of personal information:

• Identifiers: such as username, email address, account ID, IP address, and device identifiers.
• California customer records information: such as account profile, transaction records, and customer support communication records.
• Internet or other electronic network activity information: such as browsing history, search history, page visits, clicks, downloads, likes, favorites, comments, posts, and other in-service behavior.
• Geolocation information: such as approximate location inferred from IP address, or more precise location collected with your authorization.
• Commercial information: such as orders, payments, redemptions, manufacturing services, or other transaction-related records.
• Audio, electronic, visual, or similar information: such as images, videos, project files, or customer support communication materials that you voluntarily upload.
• Inferences: such as preferences, interests, or recommendation tags formed based on your browsing, favorites, downloads, posts, or interaction behavior.
• Sensitive personal information: in specific circumstances, account login credentials, precise geolocation, payment information, or private message content may constitute sensitive personal information. We process such information only to the extent necessary to provide services, ensure security, comply with law, or with your authorization.

3.2 Sources of Information: We may collect personal information from the following sources:

• Information you provide directly.
• Information automatically generated when you use the WorksBase services.
• Third-party login, payment, risk control, data analytics, customer support, or other service providers.
• Public sources, partners, or other sources permitted by applicable law.

3.3 Purposes of Use and Disclosure: We may use and disclose personal information for the following commercial or business purposes:

• To provide, maintain, and improve the WorksBase services.
• To create and manage accounts.
• To support community interactions, content publishing, downloads, comments, favorites, follows, and message notifications.
• To process transactions, payments, redemptions, manufacturing services, customer support, and disputes.
• To conduct security protection, anti-fraud, anti-abuse, content review, and risk control.
• To conduct basic data analytics, product optimization, and service quality improvement.
• To comply with legal obligations, respond to lawful requests, and protect legitimate rights and interests.
• To conduct marketing, advertising, or personalized recommendations where permitted by law and with necessary consent.

3.4 Sale or Sharing of Personal Information: We do not sell your personal information in the traditional sense of receiving monetary consideration. If WorksBase uses third-party advertising, tracking pixels, cross-site behavioral analytics, or similar technologies, certain data disclosures may be considered a "sale" or "sharing" of personal information under the CCPA / CPRA. Where applicable, we will provide a "Do Not Sell or Share My Personal Information" entry point and allow you to opt out of such processing. We do not knowingly sell or share personal information of users under the age of 16.

3.5 California Resident Rights: Within the scope of applicable law, California residents may request to know, delete, correct, opt out of sale or sharing, limit sensitive information use, obtain copies, and not receive unreasonable differential treatment when exercising privacy rights. You may submit requests through WorksBase@nestworks.ai. To protect account security, we may need to verify your identity. You may also authorize an agent to submit requests on your behalf under applicable law, but we may require proof of authorization and verification of your identity.

4. Supplemental Terms for Canadian Users

If you are located in Canada, we will process your personal information in accordance with PIPEDA and applicable provincial privacy laws.

4.1 Consent and Purpose Limitation: We will explain the processing purposes before collecting, using, or disclosing your personal information, and will obtain your consent when required by applicable law. Your consent may be express consent, or implied consent formed based on your actions and reasonable expectations in specific scenarios. We will collect, use, and disclose personal information only to the reasonable extent necessary to achieve the stated purposes, unless the law permits or requires us to process it otherwise.

4.2 Withdrawal of Consent: To the extent permitted by law, you may withdraw your consent to our processing of your personal information at any time. Withdrawal of consent may affect the availability of certain WorksBase services. Withdrawal does not affect the lawfulness of processing based on consent before withdrawal, nor does it affect our continued processing of necessary information to fulfill legal obligations, complete transactions, maintain security, resolve disputes, or protect legitimate rights and interests.

4.4 Cross-Border Processing: NestWorks is located in Shenzhen, China, and WorksBase's service providers may also be located outside Canada. Therefore, your personal information may be processed, stored, or accessed outside Canada and may be subject to local laws. We will require relevant service providers to protect your personal information to a reasonable standard through contracts, permission controls, security measures, and vendor management.

4.5 Complaints and Contact: If you have questions, requests, or complaints about how we process personal information, you may contact us at WorksBase@nestworks.ai. We will investigate and respond to your request within a reasonable period. If you are dissatisfied with our handling result, you may file a complaint with the Office of the Privacy Commissioner of Canada or the relevant provincial privacy regulator under applicable law.

5. Supplemental Terms for Users in Mainland China

If you are located in Mainland China, or your personal information is governed by the Personal Information Protection Law of the People's Republic of China (PIPL) and other applicable Chinese laws and regulations, this section supplements your rights and our obligations.

5.1 Legal Bases for Processing Personal Information: We process your personal information based on one or more of the following legal bases:

• Obtaining your consent.
• Necessity for entering into and performing a contract.
• Necessity for performing statutory duties or legal obligations.
• Necessity for responding to public health emergencies or protecting the life, health, and property safety of natural persons.
• Processing personal information within a reasonable scope for public interest news reporting, public opinion supervision, and similar activities.
• Processing personal information that you have disclosed yourself or that has otherwise been legally disclosed, unless you expressly refuse.
• Other circumstances provided by laws and administrative regulations.

When the processing purpose, processing method, or categories of personal information processed change, we will obtain your consent again, unless otherwise provided by law.

5.2 Processing of Sensitive Personal Information: Sensitive personal information that we may process includes your bank account information (for points withdrawal), precise geolocation (if you voluntarily authorize it), and similar information. Before processing sensitive personal information, we will inform you of the necessity of processing sensitive personal information and the impact on your rights and interests, and obtain your separate consent.

5.3 Your Rights: Under the PIPL, you have the right to know and decide, access and copy, correct and supplement, delete, portability, explanation, and account cancellation as described in this Policy and applicable law.

5.4 Cross-Border Provision of Personal Information: Because WorksBase serves users worldwide, your personal information may be transferred outside China. When providing personal information across borders, we will pass security assessments where applicable, obtain certification, enter into standard contracts, or take other measures required by PIPL, and obtain your separate consent before cross-border provision unless otherwise provided by laws and regulations.

5.5 Personal Information Protection Impact Assessment: We will conduct personal information protection impact assessments in accordance with law when processing sensitive personal information, using personal information for automated decision-making, entrusting or providing personal information to others, providing personal information overseas, or conducting other processing activities that may have a significant impact on your personal rights and interests.

5.6 Complaints and Remedies: You may exercise the above rights or file complaints through WorksBase@nestworks.ai. We will respond to your request within 15 business days. If you are dissatisfied with our handling result, you have the right to file a complaint or report with the department at or above the provincial level responsible for personal information protection, or file a lawsuit with a people's court in accordance with law.