Privacy policy
Last updated 22 October 2026
The short version
- We collect what we need to sell you a voucher, deliver it and keep it safe.
- Card details are handled by our payment processor, not by us.
- We never sell your personal data.
What we collect
Your email, order details and, with an account, your login and settings. When verification is required, identity documents through our verification provider Sumsub (Sum and Substance Ltd). Technical data such as IP address and device, for fraud prevention.
What we don't collect
Full card numbers or security codes. You enter those on the payment processor's form.
Why we use it
To process orders, send your codes and reminders, prevent fraud, meet legal obligations such as identity checks, and answer your messages.
Who we share it with
Our payment processor, identity verification provider, email provider and hosting providers, and the merchant where you redeem a voucher, only as far as the redemption requires. Current providers: Vercel and Supabase (hosting and database), Resend (email), Upstash (rate limiting), Sentry (error monitoring) and Sumsub (identity verification). The card processor is named on the payment page.
How long we keep it
Orders, payments and voucher records: 5 years after your last transaction. Identity verification records: 5 years after our relationship ends. Account data: until you delete your account. Technical logs: 90 days (security logs: 1 year). Newsletter: until you unsubscribe.
Your rights
You can ask to see, correct or delete your data, and object to some uses. Write to [PRIVACY EMAIL]. We follow the Hong Kong Personal Data (Privacy) Ordinance (Cap. 486). If you live in the European Economic Area or the UK, you also have your rights under the GDPR, including the right to complain to your data protection authority; in Canada, under PIPEDA; in California, under the CCPA.