Scope and data controller
The operator of Hongai determines the purposes and methods of processing personal information on this platform. This policy explains how information is handled for accounts, orders, payments, delivery, redemption, refunds, referral rewards and support. Contact on-site support with privacy questions or rights requests.
Accounts and contact information
Account services may process email addresses, display names, password hashes, verification and sign-in timestamps, account references and security status. Guest orders may process email addresses or phone numbers, separate order-query password hashes and temporary access credentials. We do not store recoverable account sign-in passwords.
Orders, payments and funds
Transactions involve products and options, quantities, prices, discounts, order status, payment methods, payment-channel references, amounts received, refund reasons and status, coverage and subscription periods, and delivery and redemption events. Manual refunds and reward withdrawals also use payout methods, account details and recipient names you submit voluntarily, solely for the relevant payment and verification.
Redemption and sensitive fulfillment details
Some recharge services require the target-account email, account identifier, AuthSession, sessionKey or other temporary authentication details specified on the product page. These carry significant security risks and are used only for eligibility verification, fulfillment requests, result queries, exception handling and support. We do not request payment passwords, SMS or email verification codes, recovery codes, seed phrases or private keys. Submit only account details you own or are legally authorized to use.
Support, security and audit information
Support and security services may process conversation subjects, message bodies, attachment details, linked orders or redemption tasks, activity logs, security summaries of IP and browser information, session identifiers, failed-attempt counts and audit records. These verify access, handle requests, prevent fraud and abuse, investigate faults, protect accounts and document transaction processing.
Processing purposes and grounds
We process information to perform your transaction, provide requested services, secure the Platform, meet applicable obligations and obtain consent where required. Purposes include registration and sign-in, order creation and lookup, payment confirmation, automatic delivery, redemption, transactional notifications, refunds and coverage, referral rewards, support and fraud prevention. We do not sell personal information to data brokers or use fulfillment details for advertising profiles.
Cookies and local storage
The Platform uses necessary cookies for sign-in sessions, guest orders, guest redemptions and referral attribution. Browser storage keeps CSRF tokens, flow idempotency identifiers and temporary redemption access state. These maintain sign-in, verify requests, restore order or redemption flows and prevent duplicate submissions. We do not use non-essential advertising-tracking cookies unless separately disclosed with appropriate choices.
Service providers and sharing
To provide services, we may share necessary information with hosting, database, content-delivery, security, payment, email, automated-fulfillment, fault-monitoring and professional-advice providers. Recipients may process information only for the agreed service purposes and must meet confidentiality, security and deletion obligations. For target-account authentication details, only the minimum fields needed for the recharge are shared. Internal supply-chain implementation is not disclosed on customer pages.
Cross-border processing
We and our providers may process data in different countries or regions. Cross-border processing uses contracts, security controls or other measures required by applicable rules and restricts access. Where mandatory local rules require additional notice, choice or consent, we provide these before enabling the relevant feature.
Retention and deletion
We retain information only as needed for these purposes, disputes, fraud prevention and applicable accounting or legal requirements. Redemption inputs and temporary authentication details are encrypted and removed at their recorded sensitive-data expiry or earlier when no longer needed. Transaction status, agreement versions, amounts, audit and support records may be retained longer. Anonymized or irreversibly aggregated data may continue to support statistics and security without identifying individuals.
Security and incident response
We use transport encryption, sensitive-field encryption, irreversible hashing or digests, access controls, least privilege, audit logs and expiry cleanup. No system can guarantee absolute security. If you suspect order credentials, account sessions or submitted authentication details have leaked, immediately revoke sessions or change credentials on the relevant third-party platform and contact on-site support.
Your choices and rights
Subject to applicable law, you may request access, correction, export or deletion of personal information; restrict or object to processing; withdraw consent-based processing; or complain about processing. Some order, payment, security and audit records cannot be deleted immediately because of contractual, fraud-prevention, dispute or legal requirements. Submit your request through on-site support. We may verify your identity to protect data.
Minors
The Platform is not primarily intended for children below the local age of majority. Minors must use it with guardian consent and supervision and must not independently submit high-risk authentication or payment details. Guardians who believe a minor submitted personal information without authorization should contact us for review and handling.
Policy updates and contact
This policy may change with features, data flows or applicable requirements. New versions show a version and effective date. Significant changes are announced prominently on the website or through other reasonable means. Orders retain a summary of the policy version accepted at creation. Contact on-site support about this policy or personal-information processing.