TP-Link Tapo

"Service Providers: To assist in our business operations and better provide Services (e.g. for software maintenance services, advertising serving technologies, e-mail services, delivery services, database management services, web analytics, and other services), we may share your information with such service provider."

TP-Link shares user data with a broad range of third parties including advertising technology providers and web analytics services, going beyond what's necessary for core product functionality.

"We will collect a device's browser history and access time when the device is under the control of the Parental Control feature. When you join our User Experience Improvement Program, we collect and process your general information of the mobile phone, including IMEI number (MEID number), system version number, SDK version number, system information, etc. and the usage status of the product functions based on your consent."

TP-Link collects deeply sensitive device data including IMEI numbers, browser history, and system information. While some is tied to specific features, the IMEI collection for a "User Experience Improvement Program" is excessive.

"You might supply us with information as: (3) your location information. We also collect the information about how you interact with our Site and Services, which may include the pages accessed and links clicked on our site, your Internet Protocol (IP) address, MAC address, access times, location, mobile device information, operating system, browser type."

TP-Link collects location information both directly from users and automatically via IP address, MAC address, and device information, enabling persistent location tracking.

"When you connect hardware devices or third-party services to your account, those hardware devices may report usage information to the Services, and the Services may read, process, and store this information for the purposes described in this Privacy Policy. Such information is usually associated with the usage of the particular hardware device or third-party service."

TP-Link aggregates usage data from multiple connected hardware devices and third-party services into a unified account, creating a cross-device profile of user activity.

"This Privacy Policy may change from time to time, and we may notify you by updating the Privacy Policy's effective date above. If there are material changes, we will place a prominent notice on this website or provide notice through other means. Your continued use of the Services after any Privacy Policy changes means that you agree to the updated Privacy Policy."

TP-Link can change the privacy policy at any time and treats continued use of their services — including hardware products already purchased — as acceptance of new terms.

"We may not accommodate a request to change or delete information if we believe the change or deletion would violate any law or legal requirement or negatively impact the information's accuracy. However, with respect to the administrative emails for your registered account, we cannot delete them except by also deleting your user account."

The policy provides no specific data retention periods or deletion timelines, and reserves broad discretion to refuse deletion requests based on vague criteria like "negatively impact the information's accuracy."

"Request data deletion at https://account-delete.tplinkcloud.com/. We may not accommodate a request to change or delete information if we believe the change or deletion would violate any law or legal requirement or negatively impact the information's accuracy."

Account deletion requires visiting a separate dedicated website rather than being available in-app, and TP-Link reserves broad discretion to refuse deletion requests.