v1.1 · Plain-language summary and full policy

YiTu Privacy Policy

Policy version: v1.1
Effective date: 2026-09-26
Last updated: 2026-09-26
Product: YiTu／译途
Operator and Privacy Officer: HAICHUAN ZHANG
Contact: privacy@yituapp.com
Service region: United States and Canada, including Quebec

Plain-language summary

What we process: When you use cloud voice features, we process speech from you and people nearby, plus English or Chinese transcripts, translations, and returned speech created from that audio. We also process limited technical data needed to connect and troubleshoot. The App stores two integers on the device: the adult-eligibility version and cloud-processing consent version.
Subscriptions, purchase verification, and anti-replay: When subscription features are available, the four cloud voice features require an active Apple monthly or annual auto-renewable subscription and separate version-6 cloud consent. To confirm current access, YiTu processes Apple-signed transaction material during a request and uses one-time Apple App Attest challenges and assertions. Each subscription allows at most three active App instances; a full-slot recovery requires a 72-hour wait and can succeed at most once every 30 days. The server retains pseudonymous instance, counter, rate, cost, and risk state, but does not persist raw App Attest key IDs or transaction IDs. YiTu does not receive card numbers, bank-account information, or Apple Account payment methods.
Who receives it: Voice features use YiTu cloud services hosted by Cloudflare and third-party AI provider OpenAI. Google processes your email address, message, and attachments only when you choose to send a support or privacy email. The static privacy site is hosted on Cloudflare Pages; Web Analytics is not enabled, no Pages Functions are used, and the operator has not configured site analytics or application-level request logging.
Why: Only to recognize speech, translate, generate and play speech, connect and secure the service, troubleshoot, answer email, and meet legal obligations. AI is not used to profile you or make decisions with legal or similarly significant effects.
Default retention: Captions, history, and returned audio remain in App runtime memory. Temporary “Speak for me” M4A files are deleted on a best-effort basis. Adult eligibility and consent versions remain on the device. The YiTu Worker has no business-content database or object storage. OpenAI defaults are in Section 6; some default abuse-monitoring logs may be kept for up to 30 days. Email is kept only as needed to handle the request, protect rights, or meet legal obligations.
Main risks: Speech may contain sensitive information about you or others. Network transmission and third-party processing cannot be risk-free. Data may be processed in the United States and other locations published by providers, where courts, law enforcement, or national-security authorities may obtain lawful access. Avoid saying information that is unnecessary for translation, and use the service only when you may lawfully provide nearby speech.

This summary highlights the main points. The full policy below controls.

1. Scope, operator, and service region

This policy applies to the YiTu／译途 iOS app (the “App”), YiTu services that support the App’s cloud features, and the static website that publishes this policy.

The subscription verification, App Attest, and instance recovery rules below apply only when the App version you use offers those subscription features and you choose to use them. The App shows whether they are available.

The operator and Privacy Officer are HAICHUAN ZHANG. The V1 user service region is fixed to the United States and Canada, including Quebec. Mainland China, Hong Kong, Macao, and all other regions are outside V1.

HAICHUAN ZHANG handles operational administration and privacy requests from Canada. The Canadian administration location and the user service region are separate facts; administration from Canada does not mean providers process data only in Canada.

The App is free to download. When subscription features are available, its four cloud voice features require an active Apple auto-renewable subscription; monthly and annual plans unlock the same features. Whether an eligible new subscriber receives a three-day free trial depends on the eligibility and effective product configuration shown by the App Store／StoreKit before purchase. The purchase screen is also the source of the actual price, currency, tax, and renewal amount.

The App has no YiTu user accounts. We do not require a name, email address, phone number, date of birth, or precise location to provide translation or look up a subscription, and we cannot retrieve purchase history through a “YiTu account.”

3. How the four voice modes work

Listen only: The App sends English speech directly to OpenAI Realtime, which creates the English transcript and Simplified Chinese translation. It does not generate or play Chinese translated speech.
Speak for me: While idle, the App automatically listens to English and displays the English transcript and Simplified Chinese translation without playing Chinese translated speech. When you press and hold to speak Chinese, the App first stops English listening and sends the Chinese recording to the YiTu Worker hosted on Cloudflare. The Worker forwards it to OpenAI to create, in sequence, a Chinese transcript, English translation, and English speech, then returns the text and audio to the App for playback. Idle English listening may resume after playback.
Listen with headphones: The App sends speech to OpenAI Realtime, receives transcripts and translations, and plays translated speech through connected headphones.
Two-way conversation: The App uses OpenAI Realtime for live Chinese and English speech, generates a source-language transcript and translation into the other language, and plays translated speech.

Nearby speech may belong to another person. Use the App only when you are entitled to provide that speech, and give notice or obtain permission when required by the circumstances and applicable law.

4. Data we process

4.1 Speech and speech-derived content

English or Chinese speech captured by the microphone;
English or Chinese transcripts, captions, and translations;
English or Chinese speech generated and returned by OpenAI;
names, health, financial, address, or other information that you voluntarily include in free-form speech. YiTu does not ask you to provide it.

4.2 Feature, connection, and diagnostic data

To connect, protect, and troubleshoot the service, the App, YiTu Worker, and providers may process the feature mode, language direction, temporary session or request identifiers, times and processing stages, network status, IP address, request headers, error category, status code, audio or text length, returned-data size, and device-side states such as microphone permission, network type, and audio route.

App diagnostic logs do not record the contents of speech, captions, transcripts, translations, or returned audio, and do not record access-credential contents. Worker application logs do not intentionally record this business content.

4.3 On-device records

The App separately stores in iOS UserDefaults:

an adult-eligibility version integer; and
a cloud-processing consent version integer.

These records do not contain a name, birth date, exact age, confirmation time, account identifier, or advertising identifier.

4.4 Subscription-verification data

To confirm current access to the four cloud features, the subscription version sends a StoreKit 2 verified transaction JWS and verified AppTransaction JWS over HTTPS to the YiTu Worker. The Worker sends the verification request through a private binding to a Cloudflare Container. The Container uses Apple’s official verification library to validate the signature, certificate chain, app, environment, product, and subscription group, and queries current subscription status through the Apple App Store Server API.

During verification, the YiTu application layer may read transaction ID, original transaction ID, AppTransaction identifier, product ID, subscription group, environment, purchase and expiration times, renewal, grace-period, refund, or revocation status in request memory only. These fields are used to confirm current entitlement, prevent unauthorized access, and protect cloud resources; they are not payment information. The YiTu App does not access card numbers, bank accounts, or Apple Account payment methods.

JWS values, transaction identifiers, Authorization, Apple private keys, and YiTu short-lived entitlement credentials must not enter YiTu application logs and are not used to create a persistent subscription profile. The Worker accepts only a minimal allowlisted Container result and issues a credential lasting no more than five minutes. The App keeps it only in memory and clears it early when it enters the background, entitlement is lost, the credential expires, or the relevant lifecycle ends.

Apple continues to process purchases, payment, renewal, refunds, subscription status, sales, and financial records under its agreements, privacy rules, security, settlement, and legal mechanisms. Cloudflare may likewise process Worker／Container network and platform metadata under its platform, security, and legal mechanisms. YiTu does not control every Apple or Cloudflare platform retention period and does not invent a uniform period.

App Attest stores an Apple-issued key reference only in the App’s ThisDeviceOnly Keychain and does not export the private key. For registration and each entitlement exchange, the server issues a one-time random challenge. It stores the challenge hash, purpose, context digest, timestamps, and consumed state—not the raw challenge—with a 120-second validity period; consumed or expired challenge digests are deleted within ten minutes. After strict verification, it stores an independently keyed HMAC pseudonym for the App instance, the registered public key, monotonic counter, environment, build/channel profile, and timestamps. A separate HMAC purpose key creates an entitlement pseudonym used for active-instance, exchange-rate, cost, circuit-breaker, and minimal risk-event state. Raw key IDs, transaction IDs, JWS values, credentials, Authorization, and request bodies must not be used as storage keys, logs, metrics, or issued credentials. These are pseudonymous rather than anonymous records and may be linked to purchase entitlement for service security. The three-instance, recovery, consent, and retention rules appear in Section 12.1.

Apple-signed App Attest attestations or assertions generated on iOS 27 and later may contain bundle-version and validation-category signals; legacy structures from older systems such as iOS 26.2 do not contain those new signals. YiTu does not infer missing values from a client OS version, Info.plist, request field, HTTP header, or User-Agent: a legacy registration stores both values as null, and only a complete extended structure that passes server allowlists stores verified values. Both structures strictly validate the Apple certificate chain and validity, nonce, RP ID, AAGUID, credential/key ID/public key, signature, counter, one-time challenge, and replay protection. The absence of the new signals alone is not treated as fraud or a ban reason. An extended-to-legacy downgrade, malformed or mismatched extension, replay, counter rollback, or anomalous rate may be a security-risk event. After a device upgrade, a verified assertion may atomically promote legacy state to extended state, but it may not downgrade. Without an extended validation category, a Production AAGUID is not described as proving TestFlight versus App Store distribution; Apple JWS/AppTransaction Sandbox/Production verification remains independent.

4.5 Static-website access data

The static pages do not set cookies, run Web Analytics or other site analytics, load third-party fonts, scripts, images, or other third-party runtime resources, or offer forms. The Pages site publishes only static files and uses no Pages Functions or application Worker; the operator has not configured site analytics or application-level request logging and does not collect or retain access logs through site code or Pages Functions. Cloudflare still processes platform network metadata to deliver pages, maintain security, and troubleshoot, such as IP addresses, request URLs and methods, times, routing and system-configuration information, request headers, response status, and error information.

The static privacy site is hosted on Cloudflare Pages. Cloudflare’s official documentation states that Direct Upload deploys static assets to its global network, so processing must not be described as occurring only in Canada or any single location. Cloudflare may process and retain Customer Logs, Network Data, and other platform records under the applicable contract, its Privacy Policy, security needs, and legal obligations. The available official documentation does not state one exact retention period that applies to every platform record for this static Pages site, and the operator does not invent one.

Cloudflare’s edge may also send NEL and Report-To response headers. When a qualifying network failure occurs, the browser may report network-failure information to Cloudflare, including the request URL, method, referrer, protocol, status, and error type. Cloudflare’s official NEL documentation states that it derives ASN, country, and metro area from the reporting request’s IP and drops the client IP from the NEL pipeline after the request is processed; this does not mean Cloudflare processes no other platform network metadata.

4.6 Email you choose to send

If you email privacy@yituapp.com for support, privacy, or security, we process your email address, message body, email metadata, and attachments you choose to add. This formal mailbox is provided through Google Workspace and supports external receiving, sending, and direct replies in Chinese, English, and French. Google, as the email provider, processes this data to send, receive, and store mail, filter spam or malicious content, and protect the account.

We use email data only to answer and manage the request, verify its scope, maintain necessary records, protect rights and security, and meet legal obligations. Do not send identity documents, audio, or other sensitive attachments unless they are necessary for the request.

5. Purposes and limits on AI use

We process data only to:

provide speech recognition, transcription, captions, translation, speech generation, and playback;
establish, maintain, end, and protect Realtime or upload connections;
apply the selected mode, language direction, adult eligibility, and consent settings;
verify current Apple subscription entitlement, prevent unauthorized access, and protect cloud resources;
detect, troubleshoot, and fix errors, prevent abuse, and maintain security;
answer support, privacy, or security email and handle rights requests; and
comply with applicable law, court orders, or valid legal process.

Where applicable law requires it, cloud processing of speech and speech-derived content is based on your consent. Providing the translation you request is also the purpose of processing. Security, troubleshooting, and legal records are limited to what is needed to maintain the service and meet obligations.

AI is used only for speech recognition, translation, and speech generation. YiTu does not use this data to profile users, assess eligibility for credit, employment, housing, insurance, education, or healthcare, or make decisions with legal or similarly significant effects.

6. Recipients, subprocessors, and default retention boundaries

We disclose data only to recipients needed to provide the service. OpenAI, Cloudflare (including the Worker used by voice features and Pages used by the static privacy site), and Google may use affiliates and necessary subprocessors to host, transmit, protect, and support their services. Those subprocessors should receive only data needed for the relevant service.

YiTu selects only providers that give user data the same or equivalent protection required by this policy and applicable law. Under service terms, data processing addenda, or other written arrangements that actually apply to the relevant account and service, providers must implement corresponding data-protection measures. Provider lists and locations may change under their published terms. Using a provider does not relieve HAICHUAN ZHANG of responsibility for protecting user data or for provider selection, instructions, and ongoing oversight. We do not claim to have a separate customized contract that does not actually apply.

6.1 YiTu App and Cloudflare Worker

In Realtime modes, media generally travels directly from the App to OpenAI using a short-lived credential; the Worker obtains that credential.
Chinese recordings, Chinese transcripts, English translations, and English speech for “Speak for me” pass through the Worker.
The Worker processes business content in memory during a request, has no configured business-content database or object storage for speech, transcripts, translations, or returned audio, and marks business responses not to be cached.
Worker application logs contain limited metadata such as request identifier, path, step, status, duration, size or length, and error code; they do not intentionally include business content or credential contents.
When subscription features are available, the Worker／Container validates Apple-signed material and current status only for the request lifecycle. It creates no YiTu account or persistent transaction profile, and the Container has no separate public business route.

Cloudflare supplies network, runtime, security, and logging infrastructure for the Worker used by the App’s voice features and may therefore process content passing through that Worker and connection metadata. The operator has not enabled Workers Logs or Traces for that Worker. Under Cloudflare’s current Workers Logs documentation, if Workers Logs is enabled for the Worker in the future, default retention is 3 days on Workers Free and 7 days on Workers Paid, with a platform maximum of 7 days. This is a Worker logging rule and does not apply to the static Pages requests described below. Other Cloudflare platform records have no single fixed period proven by this code and follow account settings, Cloudflare’s published terms, legal requirements, and deletion processes.

See Cloudflare Workers Logs, Cloudflare Privacy Policy, and Cloudflare service subprocessors.

6.2 Apple

Apple provides StoreKit, the purchase interface, auto-renewal, billing, cancellation and refund channels, and the App Store Server API. The subscription version uses Apple-signed material to verify current entitlement. Apple manages payment methods, purchase records, subscription status, and sales and settlement reports under its agreements and privacy rules. YiTu does not possess payment information and cannot decide refunds or every Apple record’s retention period.

6.3 OpenAI

Depending on the mode, OpenAI receives speech, speech-derived text, session instructions, language settings, and network and session metadata needed to connect, and returns transcripts, translations, and/or speech. YiTu data flows use Realtime, audio transcription, Responses, and speech-generation endpoints.

According to OpenAI’s current official data-controls documentation, API data is not used to train models by default unless the account opts in to sharing. The organization used by YiTu has feedback, evaluation/fine-tuning, and API input/output sharing disabled; the project uses Global residency; and API-call logging is enabled per call, with Responses store:false disabling the corresponding account-visible call log. YiTu does not claim that Zero Data Retention (ZDR), Modified Abuse Monitoring (MAM), or regional data residency is enabled.

OpenAI function	Used for training by default	Default abuse-monitoring retention	Default application state
Audio transcription	No	None	None
Realtime	No	Up to 30 days	None
Responses	No	Up to 30 days	YiTu forces `store:false`, so corresponding application state is not created
Speech generation	No	Up to 30 days	None

store:false is not ZDR and does not disable default abuse monitoring. OpenAI may retain relevant data longer when legally required or reasonably necessary to prevent severe harm. See OpenAI data controls.

6.4 Google/Gmail

Google/Gmail processes the Section 4.6 data only when you choose to email us. Email remains in the operator’s Gmail mailbox until the request is complete and it is no longer needed for follow-up, rights protection, security, or legal obligations; it is then deleted or de-identified. You may also request deletion, subject to legal-retention and security exceptions. Google explains that deletion may take time to propagate between active and backup systems and that some data may be kept for security, anti-fraud, or legal purposes. See the Google Privacy Policy.

6.5 Cloudflare Pages static-site hosting

The static privacy site is hosted on Cloudflare Pages and publishes only static files; it does not use Pages Functions. Web Analytics is not enabled, and the operator has configured no site analytics or application-level request logging. Pages Functions metrics and real-time logs apply to Function invocations; this static site has no such application invocation logs, and the 3/7-day Worker logging rule above does not apply to static Pages requests. Cloudflare may still process platform network metadata needed for delivery, security, errors, and NEL in its global infrastructure under its contracts and published policies. Official documentation does not establish one exact retention period or one processing location for every such platform record.

7. App retention and deletion

Captions, transcripts, translation history, and returned speech remain only in runtime memory. They are not written to a persistent App business-history database and do not remain there after the relevant page or lifecycle ends or the App process terminates.
“Speak for me” creates an M4A file in the system temporary directory. The App attempts deletion after a short recording, request completion or failure, cancellation, leaving the page, entering the background, consent withdrawal, or destruction of the relevant object. Deletion can fail, and a crash or forced termination can interrupt cleanup, so this is best-effort deletion rather than an absolute immediate-deletion guarantee.
Returned “Speak for me” audio is played from memory and is not saved as a persistent App audio file.
The adult-eligibility version remains until App data is cleared. The cloud-consent version remains until you withdraw, App data is cleared, or the required consent version changes.
The Worker entitlement credential stays only in App memory for no more than five minutes and may be cleared sooner on backgrounding, entitlement loss, or lifecycle end.
Apple JWS values and transaction fields read for verification remain in the YiTu application layer only for the request lifecycle and are not persisted. Worker／Container application logs must not contain those values or identifiers.
An App Attest key reference becomes the current ThisDeviceOnly Keychain record only after the server strictly accepts its attestation, and YiTu does not synchronize or export it. Reinstallation, device replacement, restoration, key loss, or a false block may require re-registration or support review. Server challenges expire after 120 seconds, are single-use, and their digests are deleted within ten minutes of consumption or expiration. Rate, cost, and circuit state is retained no longer than 30 days; necessary pseudonymous instance/counter, nullable extended signals, entitlement mapping, finalized recovery, and minimal risk state is retained during an active subscription and no longer than 90 days after release or subscription end, as detailed in Section 12.1. Support will not ask for a raw key ID, challenge, JWS, receipt, attestation, assertion, device identifier, or payment information.
Cloudflare and Apple platform, security, commercial, and legal records follow their applicable contracts, product mechanisms, and legal obligations. YiTu does not claim it can uniformly control or individually delete every platform record.

8. Cookies, analytics, ads, sale, sharing, and DNT

The YiTu App and static website contain no advertising SDK, cross-app or cross-site tracking, third-party analytics, or data-broker feature. We do not sell personal information or “share” it for cross-context behavioral advertising.

Because the App and website do not conduct cross-site or cross-app tracking, a browser Do Not Track (DNT) signal does not change our existing practices. The website does not automatically choose a language based on location or silently redirect you. You can directly open or manually switch among Chinese, English, and French pages.

9. Cross-border processing and government-access risk

Data may be processed in the United States and other processing locations published by OpenAI, Cloudflare (including Pages), Google, and their subprocessors. In particular, Realtime speech and Worker processing may occur outside your state, province, or country. The operator handles administration and privacy requests from Canada, but this does not limit provider processing to Canada.

Privacy laws may differ abroad. Foreign courts, law-enforcement agencies, or national-security authorities may obtain lawful access under local law. We use applicable processor selection, purpose and data limits, contracts, and other available safeguards, and respond to questions about cross-border processing. Using processors does not relieve HAICHUAN ZHANG of responsibility for assessing their safeguards.

10. Your choices and rights

You may:

decline or withdraw cloud-processing consent under “Privacy & Data”;
restore purchases under “Subscription & Purchases,” or use Apple’s system destination to manage or cancel the subscription;
decline or withdraw microphone permission in iOS settings;
email privacy@yituapp.com to request access to, correction of, or deletion of personal information we hold;
withdraw applicable consent and object to or restrict applicable processing;
where applicable law provides a data portability right, obtain a portable copy;
complain about our processing; and
where applicable U.S. state law provides, appeal a decision on a rights request and exercise rights without discrimination.

The App has no account, and session content in runtime memory disappears quickly. We generally cannot locate an anonymous voice session using only a name or email address. To help investigate, you may voluntarily provide an approximate date, time, mode, and error information. Do not send the contents of speech, captions, or translations unless necessary. We do not create an additional user profile to handle a rights request or ask for information beyond reasonable verification.

If data is held only by a provider within default logging boundaries, we will explain our ability to locate and delete it and, where applicable, pass the request to the processor. We cannot promise individual deletion of data the provider cannot reasonably identify.

Subscription or billing issues should first use Apple purchase history, subscription management, and refund channels. YiTu can help troubleshoot access to the four cloud features, but will not ask you to email a JWS, full receipt, Worker credential, Authorization, Apple private key, or payment information. A privacy request, withdrawal of cloud consent, and subscription cancellation are three different actions.

11. Canadian complaint channels

Please first contact the Privacy Officer at privacy@yituapp.com. You may write in Chinese, English, or French, and we will handle the request in a language reasonably suited to it. Our public Privacy Governance and Request Handling page explains responsibility, retention/destruction, and complaints. If the matter is not resolved, users in Canada may seek information or complain to:

Office of the Privacy Commissioner of Canada (OPC): official concern and complaint portal.
Commission d’accès à l’information du Québec (CAI): official remedies and complaint portal.

You may also complain to another competent authority where you live. Acceptance depends on applicable law and the authority’s jurisdiction.

12. Security

We use HTTPS, short-lived Realtime credentials, encrypted Realtime media negotiation, keep the long-lived server key out of the App, limit data by feature, exclude business content and credential contents from application logs, and stop microphones and cloud sessions when their lifecycle ends. When subscription features are available, the service also checks Apple current status, rejects proof that is no longer current, limits exchange frequency, and caps the YiTu entitlement credential at five minutes.

When subscription features are available, App Attest uses one-time challenges, signed request binding, a device-held key, and an atomically increasing counter. A user incorrectly blocked after reinstall, device replacement, restoration, an unsupported state, or key loss may re-register or request support review. Support will not ask for raw keys, JWS values, full receipts, credentials, or payment data.

No transmission, processing, or deletion method is completely secure. Do not include sensitive information in speech or email unless needed for the service. Contact privacy@yituapp.com if you suspect a privacy or security incident.

12.1 Subscription access, instance security, and retention

YiTu has no login account. One currently valid subscription may use no more than three active App instances. This limit controls product access and cost; it does not prove that all instances belong to the same Apple Account, and a finite sharing risk remains. Family Sharing is off and a Family Shared transaction is rejected.

An active, verified instance may release only its own slot. A slot is also released after 90 consecutive days without a successful server-side credential exchange. When all three slots are occupied and an old instance is unavailable, a new strictly attested instance may request recovery. It receives no cloud credential during the 72-hour wait; the three existing instances continue working. After the wait, the user must actively submit a new challenge, assertion, counter and current Apple subscription proof. At most one full-slot recovery may successfully complete per subscription in 30 days.

Each credential exchange independently verifies App Attest, a one-time challenge, assertion and counter, both Apple-signed transaction proofs, and Apple’s current subscription status. Credentials last no more than 300 seconds. Active and Apple-confirmed Billing Grace Period states may use the four cloud features, never beyond Apple’s grace expiration. Billing Retry outside grace, Expired, Revoked, Refunded, unknown, incomplete, timeout, parsing failure and Apple service failure are denied. App Store Server Notifications V2 may update a minimum early-deny/status record, but never issues access and never replaces the current-status check on every exchange; duplicates, delays, loss and reordering must not fail open.

YiTu persists no raw JWS, transaction or original transaction identifier, raw App Attest key identifier, assertion, attestation, raw challenge, business credential, Authorization value or Apple private key. Challenge digests are deleted no later than ten minutes after consumption or expiration. Rate, cost and circuit state is retained no longer than 30 days. Necessary pseudonymous App-instance, public-key, counter, entitlement mapping, finalized recovery and minimum risk state is retained while the subscription is active and no longer than 90 days after release, expiry, revocation or refund. Apple and infrastructure providers may retain platform records under their own terms; YiTu cannot promise deletion of records it does not control.

This addendum requires cloud-consent version 6. Earlier consent is not silently carried forward. Declining or withdrawing consent keeps cloud processing off but does not prevent access to non-cloud settings, cancel an Apple subscription, or replace Restore Purchases.

13. Policy changes

We may update this policy when features, providers, law, or operations change and will update the version and dates at the top. If purposes, recipients, or risks materially change, we will obtain consent again through the App where appropriate.

14. Contact

Product: YiTu／译途
Operator: HAICHUAN ZHANG
Privacy Officer: HAICHUAN ZHANG
Email: privacy@yituapp.com
Website: https://www.yituapp.com/
Privacy policy: https://www.yituapp.com/en/privacy/
Privacy governance and request handling: https://www.yituapp.com/en/governance/
Operational administration location: Canada

The Chinese, English, and French versions are intended to provide materially consistent information. If you find an inconsistency, contact the Privacy Officer. We will correct it using the interpretation that best protects your rights under applicable law and reflects actual processing.