Privacy Policy

Data controller (operating entity): LarkSim (the registered business name, unified social credit code, and registered address are those displayed in the website footer or on the order page). If you have any questions, complaints, or wish to exercise your rights in relation to personal data processing, please contact our Personal Information Protection Officer at support@larksim.com.

During the order and after-sales process, we collect only the information necessary to provide our services:

• Identity and contact information: account email address, name, mobile number
• Delivery information: province/city, full delivery address
• Order information: product, quantity, amount, order number, order status
• Payment proof: Stripe session ID, payment intent ID (we do not store your Alipay, WeChat Pay account, or bank card details)
• Log information: access time, browser/device type, IP address (used only for security and anomaly investigation)
• Affiliate information: partner application details, referral code, anonymous click identifier, attributed orders, commission and payout records

We collect only the minimum information necessary to fulfil the purposes described below, in accordance with the principles of lawfulness, legitimacy, necessity, and good faith. We do not collect personal information unrelated to the stated purposes, nor do we collect sensitive personal information such as identity documents or facial recognition data. The purpose and legal basis for processing each category of information are as follows:

• Email address, name, mobile number, delivery address — to enter into and perform the sales contract, dispatch orders, and handle after-sales matters (legal basis: necessary for entering into or performing a contract to which you are a party).
• Order information and payment proof — to complete transactions, issue refunds, and reconcile accounts (legal basis: necessary for contract performance and compliance with statutory financial and tax obligations).
• Access logs, IP address, and device information — solely to ensure network and transaction security and to investigate anomalies (legal basis: necessary to fulfil statutory network security obligations and our legitimate interests).

• Process orders, payments, dispatch, order tracking, and after-sales support
• Notify you of order status and shipping information by email
• Handle refunds, disputes, and customer enquiries
• Comply with legal obligations and prevent fraud and abnormal transactions

To fulfil orders, manage dispatch, and provide after-sales support, our authorised staff may access and export order information (including email address, mobile number, delivery address, order details, amount, and order status) for internal fulfilment and order management purposes. Such access is subject to permission controls and confidentiality obligations, and is limited to what is necessary to achieve the above purposes.

Without your explicit consent, we will not use your personal information for marketing purposes beyond those described above. For further details on how we process personal information, please refer to the relevant sections of this policy.

To deliver our services, we engage the following third parties to process specific data. We list domestic processors and overseas recipients separately:

Overseas recipients (located outside mainland China — see Section 5 'Cross-Border Transfer of Personal Information'):

• Stripe (Stripe Payments Hong Kong Limited, located in Hong Kong SAR, China): processes online payments (Alipay, WeChat Pay) and refunds. Your payment method data is collected and stored directly by Stripe in compliance with PCI DSS standards. We do not access or store your bank card number, Alipay account, or WeChat Pay account.
• Supabase (data hosted in Singapore, AWS Asia Pacific ap-southeast-1): hosts and stores order and user data.
• Resend (Resend, Inc., located in the United States): sends transactional emails such as order status updates and shipping notifications.

Domestic processors (processing logistics information within mainland China — no cross-border personal data transfer):

• KuaiDiNiao / SF Express / China Post: handle domestic express delivery and parcel tracking.

These third parties receive only the minimum information required to perform their services and independently assume responsibility for their own data processing activities.

To complete online payments, host order data, and send email notifications, some of your personal information will be transferred to and stored outside the People's Republic of China. We will disclose the details of each overseas recipient to you and seek your separate consent for each cross-border transfer.

Overseas recipients include:

• Stripe Payments Hong Kong Limited (Hong Kong SAR, China) Purpose: online payment processing (Alipay, WeChat Pay), transaction reconciliation, and dispute (chargeback) handling. Data categories: order amount, order number, Stripe session ID, payment intent ID, transaction information returned by the payment channel, and the email address used for transaction matching. Your payment method data is collected and stored directly by Stripe in compliance with PCI DSS standards; we do not retain your Alipay account, WeChat Pay account, or bank card number.
• Supabase (Singapore, AWS Asia Pacific ap-southeast-1) Purpose: host and store order and account data to support ordering, login, order enquiries, and after-sales support. Data categories: account email address, name, mobile number, province/city and full delivery address, order information (product, quantity, amount, order number, order status), payment proof ID, and log information.
• Resend, Inc. (United States) Purpose: send transactional emails such as order status updates and shipping notifications. Data categories: recipient email address, name, order number, order status, and other information necessary for email content.

Each overseas recipient processes your personal information only to the extent necessary to provide the relevant service, and will assume corresponding responsibilities in accordance with data protection requirements no less stringent than those set out in this policy.

Exercising your rights against overseas recipients: You may contact us at support@larksim.com and we will assist you in exercising your rights (access, copy, correction, supplementation, deletion, etc.) against any of the above overseas recipients. You may also contact each recipient directly in accordance with their published privacy policy. We will respond and report back to you within a reasonable period.

Separate consent: For the cross-border transfers described above, we present a separate, unchecked checkbox on the checkout page to individually notify you of the arrangements in this Section 5 (including the name, location, processing purpose, and data categories for each overseas recipient) and ask you to actively check the box to confirm. Payment may only proceed after you actively check the separate consent box. This consent is independent of your acceptance of this policy as a whole, and we will record the time at which you give consent for verification purposes. You may withdraw this separate consent at any time by contacting us at support@larksim.com. Withdrawal does not affect any processing carried out prior to withdrawal. If you do not consent to the cross-border transfer, we will be unable to complete your online payment or fulfil your order, and you may choose not to use the relevant services.

We retain your personal information only for as long as necessary to fulfil the purposes described in this policy:

• Order and fulfilment information (including delivery address, mobile number, and order records): retained for 3 years from the date the order is completed, to handle potential after-sales matters, refunds, and disputes, and to meet the requirement under Article 31 of the E-Commerce Law to retain product/service and transaction information for no less than three years.
• Account and login information: retained for the duration of your account; within 15 business days of account cancellation, we will delete or anonymise the data, except where retention is required by law.
• Transaction and payment proof (Stripe session ID, payment intent ID): retained in accordance with applicable financial and tax regulations.
• Access logs: retained for no more than 6 months, used only for security and anomaly investigation.

Once the retention period expires, we will delete or anonymise your personal information. Where deletion is required by law or is technically impracticable, we will cease all processing other than storage and the necessary security protection measures.

We implement industry-standard technical and organisational measures to protect your personal information, including: HTTPS encryption at the transport layer, server-side access controls and least-privilege authorisation, encryption or pseudonymisation of sensitive fields, operational audit logs, and access management and confidentiality obligations for our staff. Notwithstanding these measures, no safeguard can guarantee absolute security. In the event of an actual or suspected personal information breach, alteration, or loss, we will immediately activate our incident response plan, take remedial action, and promptly notify you and the relevant competent authorities of the incident details, potential impact, and protective steps you can take, as required by law. We do not actively sell or rent your personal information to third parties.

We use strictly necessary cookies, such as session credentials, to maintain login and back-end session state. Before you actively choose Allow analytics, we do not load Google Analytics or persist UTM attribution used for ordinary channel analytics. If you allow it, we use Google Analytics 4 for anonymous page, product-view, checkout and paid-order events, and retain first-touch UTM source, medium, campaign, content, landing page and an anonymous Analytics client identifier in browser storage for up to 30 days. When you arrive through a partner referral link, we store the referral code, a random anonymous visitor identifier and first-visit time in browser storage for the period shown on the affiliate page (30 days by default). This is used to perform the affiliate agreement and attribute a later valid order to that partner; it does not depend on Google Analytics consent and does not store your name, email or payment account details. Clearing browser storage also clears unused referral attribution. If you complete an order, the relevant UTM or referral snapshot is written to the order record and retained under section 6. We do not send your name, phone number, email, shipping address or payment account details to Google Analytics, and do not use it for cross-site advertising. Rejecting ordinary analytics does not affect checkout, payment or core site functions.

Our website and services are intended for adults aged 18 and over. We will not knowingly sell products to or collect personal information from persons under the age of 18. If you are under 18, please use our services with the accompaniment and consent of a guardian. If we process the personal information of children under the age of 14, we will obtain the consent of their parent or other guardian and formulate a dedicated children's personal information processing policy as required by law. If a guardian discovers that we have collected a child's personal information without consent, please contact us at support@larksim.com and we will promptly verify and delete the information.

Subject to applicable law, you have the following rights in respect of your personal information and may submit a request to support@larksim.com:

• Access and copy: you may request access to and a copy of the personal information we hold about you.
• Portability: where the conditions prescribed by the national cyberspace authority are met, you may request that we transfer your personal information to a personal information processor designated by you. The specific transfer pathway and conditions are subject to the rules issued by the national cyberspace authority at the relevant time; at this stage we will assist to the extent technically feasible.
• Rectification and supplementation: where your information is inaccurate or incomplete, you may request rectification or supplementation.
• Deletion: you may request deletion where the processing purpose has been fulfilled, you withdraw your consent, we process your data unlawfully, or in other circumstances prescribed by law.
• Withdrawal of consent: for processing based on your consent (including cross-border transfers and email notifications), you may withdraw consent at any time. Withdrawal does not affect the validity of processing carried out prior to withdrawal, but may mean we are unable to continue providing the relevant services. You may also unsubscribe from email notifications by clicking the unsubscribe link in any email.
• Account cancellation: you may apply to cancel your account, after which we will delete or anonymise your personal information (except where retention is required by law).
• Explanation: you may request an explanation of our personal information processing rules.

Where your information involves an overseas recipient (see Section 5 'Cross-Border Transfer of Personal Information'), you may contact us at support@larksim.com and we will assist you in relaying and exercising the above rights against the relevant overseas recipient. For security purposes, we may need to verify your identity first. We will respond within 15 business days of receiving your request; where the matter is complex, we will notify you and extend the period appropriately. We do not generally charge a fee for handling your request, but may charge a reasonable cost for unreasonable or repetitive requests. If we decide not to act on your request, we will explain why.

We may update this policy from time to time in response to changes in law or in our business. Where material changes are made — such as changes to the purpose, method, or categories of processing — we will notify you prominently through an announcement on this page, email, or in-site notification, and will seek your consent again where required by law. Please check this page periodically for the latest version. The updated policy takes effect on the date of publication.

The formation, interpretation, and dispute resolution of this policy are governed by the laws of the People's Republic of China.

For any privacy-related questions or to exercise your rights, please contact us at: support@larksim.com

You may submit a personal information rights request or complaint to us at support@larksim.com and we will respond within 15 business days. If you believe that our processing has infringed your lawful rights and interests and negotiations with us have been unsuccessful, you may also lodge a complaint or report with the relevant competent authorities (such as the cyberspace or market regulation authority) or bring legal proceedings as permitted by law.

This policy takes effect on 13 June 2026 and may be updated periodically. The latest version on this page shall prevail.