Privacy Policy

Data controller (operating entity): LarkSim (the registered business name, unified social credit code, and registered address are those displayed in the website footer or on the order page). If you have any questions, complaints, or wish to exercise your rights in relation to personal data processing, please contact our Personal Information Protection Officer at support@larksim.com.

During the order and after-sales process, we collect only the information necessary to provide our services:

• Identity and contact information: account email address, name, mobile number
• Delivery information: province/city, full delivery address
• Order information: product, quantity, amount, order number, order status
• Legal acceptance record: the version and acceptance time of the Terms, Refund Policy, and Risk Disclosure, used to evidence the order agreement and handle after-sales disputes
• Payment proof: Stripe session ID, payment intent ID (we do not store your Alipay, WeChat Pay account, or bank card details)
• Log information: access time, browser/device type, IP address (used only for security and anomaly investigation)
• Affiliate information: partner application details, referral code, anonymous click identifier, attributed orders, commission and payout records

We collect only the minimum information necessary to fulfil the purposes described below, in accordance with the principles of lawfulness, legitimacy, necessity, and good faith. We do not collect personal information unrelated to the stated purposes, nor do we collect sensitive personal information such as identity documents or facial recognition data. The purpose and legal basis for processing each category of information are as follows:

• Email address, name, mobile number, delivery address — to enter into and perform the sales contract, dispatch orders, and handle after-sales matters (legal basis: necessary for entering into or performing a contract to which you are a party).
• Order information and payment proof — to complete transactions, issue refunds, and reconcile accounts (legal basis: necessary for contract performance and compliance with statutory financial and tax obligations).
• Legal acceptance records — to form and retain the order agreement and respond to after-sales matters and disputes (legal basis: necessary to enter into and perform the contract, comply with legal duties, and handle claims).
• Access logs, IP address, and device information — solely to ensure network and transaction security and to investigate anomalies (legal basis: necessary to fulfil statutory network security obligations and our legitimate interests).
• Website analytics and interaction data — including Google Analytics page_location limited to origin and path; Microsoft Clarity page URLs limited to origin, path, and strictly allowlisted parameters; referrers; format-validated UTM parameters; approximate location inferred from IP; Analytics/Clarity cookies or pseudonymous identifiers; device/browser information; clicks, scrolling, mouse movements, whether input occurred (but not input content), page structure, performance and error information, masked session replays, and an order-number tag, used to analyse website, tool, and checkout experience; this analytics processing is enabled by default when you visit the website, as described in Section 8.

• Process orders, payments, dispatch, order tracking, and after-sales support
• Notify you of order status and shipping information by email
• Handle refunds, disputes, and customer enquiries
• Comply with legal obligations and prevent fraud and abnormal transactions
• Analyse page and tool usage, clicks, scrolling, heatmaps, and masked session replays to improve the website and checkout flow

To fulfil orders, manage dispatch, and provide after-sales support, our authorised staff may access and export order information (including email address, mobile number, delivery address, order details, amount, and order status) for internal fulfilment and order management purposes. Such access is subject to permission controls and confidentiality obligations, and is limited to what is necessary to achieve the above purposes.

Without your explicit consent, we will not use your personal information for marketing purposes beyond those described above. For further details on how we process personal information, please refer to the relevant sections of this policy.

To deliver our services, we engage the following third parties to process specific data. We list domestic processors and overseas recipients separately:

Overseas recipients (located outside mainland China — see Section 5 'Cross-Border Transfer of Personal Information'):

• Stripe (Stripe Payments Hong Kong Limited, located in Hong Kong SAR, China): processes online payments (Alipay, WeChat Pay) and refunds. Your payment method data is collected and stored directly by Stripe in compliance with PCI DSS standards. We do not access or store your bank card number, Alipay account, or WeChat Pay account.
• Supabase (data hosted in Singapore, AWS Asia Pacific ap-southeast-1): hosts and stores order and user data.
• Resend (Resend, Inc., located in the United States): sends transactional emails such as order status updates and shipping notifications.
• Google Analytics (Google LLC, located in the United States): loads by default when you visit the website to analyse traffic sources, page views, product views, tool usage, checkout, and paid-order events. We disable Google signals and advertising-personalisation signals and do not send your name, email address, mobile number, delivery address, or payment-account details. See Google's Privacy Policy for details of its processing.
• Microsoft Clarity (Microsoft Corporation, located in the United States): loads by default when you visit the website and provides behavioural metrics, heatmaps, and masked session replay to help us analyse website, tool, and checkout experience. We attach only the order number as a pseudonymous filter tag and do not send your name, email address, mobile number, delivery address, or payment-account details. See Microsoft's Privacy Statement for details of its processing.

Domestic processors (processing logistics information within mainland China — no cross-border personal data transfer):

• KuaiDiNiao / ZTO Express: handle domestic delivery, courier recognition, and parcel tracking.

These third parties receive only the minimum information required to perform their services and independently assume responsibility for their own data processing activities.

To complete online payments, host order data, send email notifications, and analyse website behaviour, some of your personal information will be transferred to and stored outside the People's Republic of China. This Section identifies each overseas recipient; order-related transfers required for payment, order hosting, and transactional email remain subject to a separate pre-payment confirmation.

Overseas recipients include:

• Stripe Payments Hong Kong Limited (Hong Kong SAR, China) Purpose: online payment processing (Alipay, WeChat Pay), transaction reconciliation, and dispute (chargeback) handling. Data categories: order amount, order number, Stripe session ID, payment intent ID, transaction information returned by the payment channel, and the email address used for transaction matching. Your payment method data is collected and stored directly by Stripe in compliance with PCI DSS standards; we do not retain your Alipay account, WeChat Pay account, or bank card number.
• Supabase (Singapore, AWS Asia Pacific ap-southeast-1) Purpose: host and store order and account data to support ordering, login, order enquiries, and after-sales support. Data categories: account email address, name, mobile number, province/city and full delivery address, order information (product, quantity, amount, order number, order status), payment proof ID, and log information.
• Resend, Inc. (United States) Purpose: send transactional emails such as order status updates and shipping notifications. Data categories: recipient email address, name, order number, order status, and other information necessary for email content.
• Google LLC / Google Analytics (United States) Purpose: analyse traffic sources, page and tool usage, product views, checkout, and paid-order events to improve the website and conversion flow. Data categories: page URLs limited to origin and path, with no query parameters or URL fragments; referrers and format-validated UTM parameters; approximate location inferred from IP; Analytics cookies or client identifiers; browser and device information; and page-view, product, tool, checkout, and payment events. We do not intentionally populate analytics events or tags with name, email address, mobile number, delivery address, or payment-account details.
• Microsoft Corporation / Microsoft Clarity (United States) Purpose: analyse page usage, clicks, scrolling, heatmaps, and masked session replay to improve the website and checkout flow. Data categories: page URLs limited to origin and path plus UTM, partner code, product, login-return path, flow-state, or simple-anchor values that pass strict name, format, and length allowlists; referrers; approximate location inferred from IP; Clarity cookies or pseudonymous identifiers; browser and device information; clicks, scrolling, mouse movements, whether input occurred (but not input content), interaction, performance and error data, masked page structure, and the order number as a pseudonymous filter tag. Clarity is not loaded on a page containing unknown parameters, advertising click identifiers, cross-domain linker identifiers, authentication credentials, or suspicious values. We do not intentionally populate Clarity tags with name, email address, mobile number, delivery address, or payment-account details.

Each overseas recipient processes your personal information only to the extent necessary to provide the relevant service, and will assume corresponding responsibilities in accordance with data protection requirements no less stringent than those set out in this policy.

Exercising your rights against overseas recipients: You may contact us at support@larksim.com and we will assist you in exercising your rights (access, copy, correction, supplementation, deletion, etc.) against any of the above overseas recipients. You may also contact each recipient directly in accordance with their published privacy policy. We will respond and report back to you within a reasonable period.

Analytics services and order-related cross-border confirmation: Google Analytics and Microsoft Clarity load by default when you visit the website, without a separate analytics-consent prompt; their purposes, data categories, and overseas recipients are disclosed in this policy. For order-related cross-border transfers required for payment, order hosting, and transactional email, the pre-payment confirmation dialog separately presents the arrangements in this Section 5 and requires the independent ‘I understand and separately consent, continue to payment’ action; the confirmation time is recorded with the order. This confirmation is independent of your acceptance of the Terms and Refund Policy. You may withdraw the separate consent for order-related cross-border transfers by contacting us at support@larksim.com. Withdrawal does not affect any processing carried out prior to withdrawal. If you do not consent to those order-related cross-border transfers, we will be unable to complete your online payment or fulfil your order, and you may choose not to use the relevant services.

We retain your personal information only for as long as necessary to fulfil the purposes described in this policy:

• Order and fulfilment information (including delivery address, mobile number, and order records): retained for 3 years from the date the order is completed, to handle potential after-sales matters, refunds, and disputes, and to meet the requirement under Article 31 of the E-Commerce Law to retain product/service and transaction information for no less than three years.
• Account and login information: retained for the duration of your account; within 15 business days of account cancellation, we will delete or anonymise the data, except where retention is required by law.
• Transaction and payment proof (Stripe session ID, payment intent ID): retained in accordance with applicable financial and tax regulations.
• Access logs: retained for no more than 6 months, used only for security and anomaly investigation.
• Google Analytics and order-attribution data: first-touch UTM attribution is retained in browser storage for up to 30 days. The Google Analytics _ga cookie and platform-side event/user data are processed according to the current property configuration and Google's then-applicable retention rules. When an order is successfully created, the Analytics client identifier is retained as an order-attribution field with the order record and follows the 3-year order-record period above.
• Microsoft Clarity behavioural analytics data: session replays are normally retained for 30 days; favourited or platform-sampled replays and aggregated click/heatmap data may be retained for up to 9 months, subject to Microsoft Clarity's then-current retention rules.

Once the retention period expires, we will delete or anonymise your personal information. Where deletion is required by law or is technically impracticable, we will cease all processing other than storage and the necessary security protection measures.

We implement industry-standard technical and organisational measures to protect your personal information, including: HTTPS encryption at the transport layer, server-side access controls and least-privilege authorisation, encryption or pseudonymisation of sensitive fields, operational audit logs, and access management and confidentiality obligations for our staff. Notwithstanding these measures, no safeguard can guarantee absolute security. In the event of an actual or suspected personal information breach, alteration, or loss, we will immediately activate our incident response plan, take remedial action, and promptly notify you and the relevant competent authorities of the incident details, potential impact, and protective steps you can take, as required by law. We do not actively sell or rent your personal information to third parties.

We use strictly necessary cookies, such as session credentials, to maintain login and back-end session state. When you visit this website, including SIMReady tool pages, Google Analytics 4 and Microsoft Clarity load by default after the page becomes interactive, without a separate analytics-consent prompt. OAuth authentication callback pages skip both services entirely until the authentication parameters have been processed and the browser leaves that page. Google Analytics page_location is fixed to origin and path, without query parameters or URL fragments. The browser retains parameters needed for product selection, login return, refund intent, UTM and partner attribution, and Google's cross-domain linking; Google may process the _gl identifier under its linker mechanism. Microsoft Clarity loads only when the current URL parameters and anchor pass strict name, format, and length allowlists. The allowlist is limited to validated UTM, partner code and method, product, fulfilment type, refund intent, login-return path, cancellation state, and simple page anchors. session_id and order_id are removed from the address bar first; a page with unknown parameters, advertising click identifiers, _gl, authentication credentials, or suspicious values does not load Clarity. Google Analytics 4 records traffic sources, page views, product views, tool usage, checkout, and paid-order events; we disable Google signals and advertising-personalisation signals. Microsoft Clarity processes referrers, approximate location inferred from IP, Clarity cookies or pseudonymous identifiers, clicks, scrolling, mouse movements, whether input occurred (but not input content), browser/device information, page structure, performance and error information, heatmaps, and masked session replay to improve the website, tools, and order flow. First-touch UTM source, medium, campaign, content, and landing page are retained in browser storage for up to 30 days; Google Analytics cookies, platform data, and the Analytics client identifier retained with an order follow the distinct periods in Section 6. We attach the order number to Clarity as a pseudonymous filter tag when an order is successfully created. Checkout, account, order, logistics, voucher-code, support, and the SIMReady date-input area are explicitly masked. We do not intentionally populate Google Analytics events or Microsoft Clarity tags with your name, mobile number, email address, delivery address, or payment-account details, and do not use either service for cross-site advertising. Clarity adjusts cookie access and consent mode according to visitor location and its platform rules. Partner-referral attribution is stored separately in the browser for 30 days by default to attribute a later valid order to that partner.

Our website and services are intended for adults aged 18 and over. We will not knowingly sell products to or collect personal information from persons under the age of 18. If you are under 18, please use our services with the accompaniment and consent of a guardian. If we process the personal information of children under the age of 14, we will obtain the consent of their parent or other guardian and formulate a dedicated children's personal information processing policy as required by law. If a guardian discovers that we have collected a child's personal information without consent, please contact us at support@larksim.com and we will promptly verify and delete the information.

Subject to applicable law, you have the following rights in respect of your personal information and may submit a request to support@larksim.com:

• Access and copy: you may request access to and a copy of the personal information we hold about you.
• Portability: where the conditions prescribed by the national cyberspace authority are met, you may request that we transfer your personal information to a personal information processor designated by you. The specific transfer pathway and conditions are subject to the rules issued by the national cyberspace authority at the relevant time; at this stage we will assist to the extent technically feasible.
• Rectification and supplementation: where your information is inaccurate or incomplete, you may request rectification or supplementation.
• Deletion: you may request deletion where the processing purpose has been fulfilled, you withdraw your consent, we process your data unlawfully, or in other circumstances prescribed by law.
• Withdrawal of consent: for processing based on your consent (including order-related cross-border transfers separately confirmed before payment and email notifications), you may withdraw consent at any time. Withdrawal does not affect the validity of processing carried out prior to withdrawal, but may mean we are unable to continue providing the relevant services. You may also unsubscribe from email notifications by clicking the unsubscribe link in any email.
• Account cancellation: you may apply to cancel your account, after which we will delete or anonymise your personal information (except where retention is required by law).
• Explanation: you may request an explanation of our personal information processing rules.

Where your information involves an overseas recipient (see Section 5 'Cross-Border Transfer of Personal Information'), you may contact us at support@larksim.com and we will assist you in relaying and exercising the above rights against the relevant overseas recipient. For security purposes, we may need to verify your identity first. We will respond within 15 business days of receiving your request; where the matter is complex, we will notify you and extend the period appropriately. We do not generally charge a fee for handling your request, but may charge a reasonable cost for unreasonable or repetitive requests. If we decide not to act on your request, we will explain why.

We may update this policy from time to time in response to changes in law or in our business. Where material changes are made — such as changes to the purpose, method, or categories of processing — we will notify you prominently through an announcement on this page, email, or in-site notification, and will seek your consent again where required by law. Please check this page periodically for the latest version. The updated policy takes effect on the date of publication.

The formation, interpretation, and dispute resolution of this policy are governed by the laws of the People's Republic of China.

For any privacy-related questions or to exercise your rights, please contact us at: support@larksim.com

You may submit a personal information rights request or complaint to us at support@larksim.com and we will respond within 15 business days. If you believe that our processing has infringed your lawful rights and interests and negotiations with us have been unsuccessful, you may also lodge a complaint or report with the relevant competent authorities (such as the cyberspace or market regulation authority) or bring legal proceedings as permitted by law.

This policy takes effect on 13 June 2026 and may be updated periodically. The latest version on this page shall prevail.