执法请求政策
执法请求政策
最近更新：2026-10-10
本政策说明执法机构与政府部门如何向 Unimatcha（下称「抹茶」「我们」）请求用户数据，以及我们如何处理这些请求。我们是英国公司，按英国法律（包括 UK GDPR 与《2018 年数据保护法》）处理请求。我们重视用户隐私，也愿意配合合法的调查。
1. 适用范围
本政策适用于警方、检察机关、法院及其他政府部门提出的数据请求。民事诉讼当事人或其律师的请求，须提供有效的法院命令。用户想获取自己的数据，请按《隐私协议》行使权利，不适用本政策。
2. 如何提交请求
请从官方机构邮箱发送到 contact@unimatcha.ai，邮件标题注明「Law Enforcement Request」。请求应包含：
- 请求机构名称、经办人姓名、职务、警号或工号，以及可回复的官方联系方式；
- 能识别账号的信息，例如注册邮箱或账号编号（仅凭昵称通常无法准确定位）；
- 所需数据的具体范围与时间段，以及请求的法律依据；
- 有效的法律文书副本；
- 是否要求我们不通知用户，以及对应的法律依据。
范围过宽或不清楚的请求，我们可能要求补充说明或缩小范围。
3. 法律程序要求
- 英国机构：须提供按英国法律有效的法律文书，例如法院命令、出示令，或依《2016 年调查权力法》等法律作出的授权；
- 英国以外的机构：一般须通过司法协助条约（MLAT）或其他英国认可的国际程序提出；
- 我们会逐一审查每项请求的合法性与范围，只提供法律文书要求、且我们实际持有的数据。对不合法、范围过宽或缺乏依据的请求，我们会提出异议或拒绝。
4. 紧急请求
如果存在对他人生命或严重人身伤害的迫在眉睫的危险，我们可以在没有法律文书的情况下，依法披露防止伤害所必需的信息。请在邮件标题注明「EMERGENCY」，说明危险的性质与紧迫程度、所需信息，以及为什么来不及走常规法律程序。我们可能要求事后补交正式文书。
5. 我们可能持有的数据
- 账号信息：注册邮箱、账号编号、注册时间、学校与认证状态；
- 资料与内容：个人资料、照片、帖子、评论，以及应用内聊天记录；
- 技术记录：在我们保留的期限内，可能包括登录时间、IP 地址与设备信息；
- 订单记录：方糖与门票的金额、币种、时间，以及 Stripe 的订单号与付款编号。
我们不持有银行卡号等支付凭据——这些由 Stripe 或对应的支付机构持有，相关请求请直接联系对方。账号注销后，我们会在 30 天内删除个人信息；订单记录按英国会计法规一般保留六年。已删除的数据我们无法提供。
6. 数据保全
在正式法律文书送达之前，执法机构可以请求我们保全指定账号的数据。收到合理的保全请求后，我们会将相关数据冻结保存 90 天，期间可以书面申请延长一次。保全不等于披露：提供数据仍须符合第 3 条的要求。
7. 通知用户
我们的做法是在披露前通知相关用户，让他们有机会寻求法律帮助。以下情况除外：法律或法院命令禁止通知；通知可能危及他人人身安全；或可能妨碍正在进行的调查。限制解除后，我们可能补发通知。
8. 其他
- 我们不会在系统中设置后门，也不会主动向任何机构批量提供用户数据；
- 发现涉及儿童性剥削的内容时，我们会依法向有关机构报告；
- 本政策不构成我们的任何法律义务或第三方权利，我们可以根据法律变化随时更新。
执法请求与本政策相关的问题，请写信到 contact@unimatcha.ai。
LAW ENFORCEMENT REQUESTS
Law Enforcement Requests
Last updated: 2026-10-10
This policy explains how law enforcement and government authorities can request user data from Unimatcha ("we", "us"), and how we handle those requests. We are a UK company and handle requests under UK law, including the UK GDPR and the Data Protection Act 2018. We take our users' privacy seriously and cooperate with lawful investigations.
1. Scope
This policy covers data requests from police, prosecutors, courts and other government authorities. Requests from parties to civil proceedings, or their lawyers, require a valid court order. Users who want their own data should exercise their rights under our Privacy Policy; this policy does not apply to them.
2. How to submit a request
Email contact@unimatcha.ai from an official agency address, with "Law Enforcement Request" in the subject line. Please include:
- The requesting agency, the officer's name, rank or title, badge or ID number, and an official contact address for our reply;
- Information that identifies the account, such as the registered email address or account ID (a display name alone is usually not enough);
- The specific data and time period requested, and the legal basis for the request;
- A copy of the valid legal process;
- Whether you ask us not to notify the user, and the legal basis for that.
We may ask for clarification, or for a narrower scope, if a request is overly broad or unclear.
3. Legal process
- UK authorities: we require legal process valid under UK law, such as a court order, a production order, or an authorisation under the Investigatory Powers Act 2016 or other applicable legislation;
- Authorities outside the UK: requests should generally come through a Mutual Legal Assistance Treaty (MLAT) or another process recognised in the UK;
- We review every request for lawfulness and scope and disclose only the data the legal process requires and that we actually hold. We will push back on, or refuse, requests that are unlawful, overly broad or lack a proper basis.
4. Emergency requests
Where there is an imminent risk of death or serious physical harm to someone, we may disclose information necessary to prevent that harm without legal process, as the law allows. Put "EMERGENCY" in the subject line and describe the nature and urgency of the danger, the information needed, and why the usual legal process cannot be followed in time. We may ask for formal legal process afterwards.
5. Data we may hold
- Account information: registered email, account ID, sign-up date, university and verification status;
- Profile and content: profile details, photos, posts, comments and in-app chat messages;
- Technical records: for the period we keep them, possibly sign-in times, IP addresses and device information;
- Order records: amount, currency and time of sugar cube and ticket purchases, and the Stripe order and payment references.
We do not hold card numbers or other payment credentials — Stripe or the relevant payment provider holds them, so please direct those requests to them. When an account is deleted we erase its personal data within 30 days; order records are generally kept for six years under UK accounting rules. We cannot provide data that has been deleted.
6. Preservation requests
Before formal legal process is served, an authority may ask us to preserve the data of a specific account. On receiving a reasonable preservation request we will preserve the relevant data for 90 days, which may be extended once on written request. Preservation is not disclosure: disclosure still requires legal process as set out in section 3.
7. User notice
Our practice is to notify affected users before disclosing their data, so they have a chance to seek legal advice. We will not do so where notice is prohibited by law or court order, where it could endanger someone's safety, or where it could obstruct an ongoing investigation. Once a restriction lifts, we may notify the user.
8. Other
- We do not build backdoors into our systems, and we do not voluntarily provide bulk user data to any authority;
- Where we find content involving child sexual exploitation, we report it to the relevant authorities as the law requires;
- This policy creates no legal obligations for us and no rights for third parties, and we may update it as the law changes.
For law enforcement requests and questions about this policy: contact@unimatcha.ai.