Privacy policy

Business enquiries

For wholesale and partnership enquiries we collect your contact name, business email, company or store name, country, store or marketplace link, product interests, expected volume and message. We use these details to assess and respond to the proposed business relationship, not to subscribe you to marketing. Your enquiry is sent to our business inbox through our email provider. Abuse-prevention records use hashed identifiers; do not include passwords, identity documents or gift card codes.

Who handles your data

Eyad Store Limited, RM 1307, 13/F, Kenbo Commercial Building, 335-339 Queen's Road West, Hong Kong, is responsible for personal information handled by Eyadcards. Email info@eyadcards.com or open a support ticket to ask about your information; identify it as a privacy request. Providing order, account or support details is necessary for the corresponding service; optional fields are identified in the form.

Information and purposes

Account details and sign-in records are used to manage access and account security. Cart contents, saved products, order details, payment references and fulfillment records are used to provide shopping, delivery, support and dispute handling. Contact messages and the reply address you provide are used to answer your enquiry.

Technical information such as IP address, approximate country, browser details and security events may be processed by the site and its infrastructure to operate the service, enforce location restrictions and prevent abuse. If a verification review is required, we explain the information requested through the approved verification process. Do not put identity documents or full card details in a support message.

Where a legal basis is required, processing relies on performing the requested service, applicable legal obligations, and legitimate interests in security and resolving disputes where permitted. Optional consent-based processing requires a separate choice; accepting purchase terms is not marketing consent.

Service providers and disclosures

Hosting, database, security and email services process information needed to run the store. The current stack uses Vercel and Neon; Cloudflare security services and Resend email are used when configured. Payment providers process payment information under their own notices when you select an available method. The card issuer may receive the order or code details needed to deliver the product or investigate a code, not unrestricted access to your account.

We may disclose relevant records to a payment provider for a dispute, professional advisers, or competent authorities where required or permitted by law. We do not sell customer data. A wishlist is private to your account, not a public profile.

Cookies and browser settings

Essential cookies support sign-in, security and the cart. Preference cookies remember your chosen language, currency and shopping region. The contact form uses Cloudflare Turnstile when enabled to check for automated abuse. Optional advertising and Google analytics integrations are currently disabled. Turning on optional tracking requires an updated notice and any legally required consent before it starts.

You can manage cookies in your browser, but blocking essential cookies may prevent sign-in or checkout.

Retention and overseas processing

Information may be processed outside your country, including in the United States and the countries where our providers operate. Applicable contractual and legal safeguards must be used for such transfers.

Records are retained according to their purpose: open accounts and orders, unresolved support or disputes, fraud prevention and legal accounting obligations may require different periods. We review deletion requests against these needs and explain any lawful exception. Closing an account does not immediately erase records needed for an outstanding dispute or legal obligation.

Your choices and rights

You may request access to and correction of your information. Depending on the applicable law, you may also request deletion, restriction, portability or object to processing, and withdraw consent for consent-based uses without affecting earlier lawful processing. We may ask for proportionate verification before disclosing or changing account information.

You can ask for human review of an account or order restriction through Contact. You may complain to the Hong Kong Privacy Commissioner for Personal Data or the relevant authority where you live. We do not require you to surrender legal rights to use this process.

Support attachments and verification

Support tickets may contain messages and image attachments. They are available to the ticket owner and authorized support administrators, not other customers. Attach only what is necessary, hide redemption codes and sensitive payment details, and do not upload identity documents to tickets.

If account verification is requested, use the separate verification flow. Submitted verification information and review decisions are handled for security, eligibility checks and applicable legal obligations, with access restricted to authorized reviewers. We may need to retain relevant records for an unresolved dispute or a legal obligation; request a review of retention through info@eyadcards.com.

Private identity and payment verification

If we request verification, use the separate verification page in your account. The form collects your name, payment-card type and last four digits, a photo of you holding your identity document, and a photo of the card you paid with. You acknowledge the verification purpose before uploading. Do not send these documents by email or in a support ticket. Cover the full card number, CVV, passwords, one-time codes and unrelated financial information; leave only the last four card digits visible.

Verification files are encrypted on our server before storage in a dedicated private Vercel Blob store. They have no public document links. Only currently authorized administrators can view them through a protected review page, and document access is recorded in an audit log. Other customers cannot view your documents. We use the documents and review decisions to check account ownership and payment authorization, resolve a requested verification review, and investigate relevant fraud or disputes.

Security identifiers and payment records

For payment security we keep relevant attempt and order references, amounts, status, timestamps and review decisions. Where applicable, security records use keyed hashes of your email address, trusted IP address, a random browser security identifier, and validated delivery-recipient identifiers. A private security cookie supplies the browser identifier for payment methods subject to card-payment risk checks. These records help identify repeated attempts or linked accounts requiring review; they are not used for advertising.

Hashing reduces exposure of the original identifiers, but these security records can still be linked to an account, payment attempt or order and are not anonymous. Access is limited to the people and service providers needed for security, payment handling and review. You may request a human review of an account or order restriction through our support contacts.

Verification retention and deletion requests

Our team reviews verification-file retention and deletion manually. Documents are kept only while needed for the verification review or a documented security, dispute or legal purpose. An approval, rejection or account closure does not automatically delete uploaded documents. We review the need for continued retention and remove documents that are no longer needed; minimal review and access records may need to remain.

To request access, correction, a retention review or deletion, email info@eyadcards.com or open a support ticket from your account. Identify the account or verification request, but do not attach identity documents or payment-card details to the message. We review the request and explain any records that must be retained.