Privacy Policy
Last updated: 2026-10-21
This English version is provided for convenience. If there is any inconsistency, the Traditional Chinese version prevails.
*This policy is a template and should be reviewed by a professional familiar with Hong Kong’s Personal Data (Privacy) Ordinance (Cap. 486) before launch.
Xingban BaZi (星伴八字, operated by 【待填】營運公司名稱; “we”) cares about your privacy. This policy explains, in line with the Personal Data (Privacy) Ordinance (PDPO) and its six Data Protection Principles, how we collect, use and protect your personal data.
1. What we collect
- Account details: your name, email and a hashed password (we can’t see your password). If you check out with “email only”, we use that email to create (or link to) an account automatically, with no password; you can choose to set one later.
- How your email is used: only to (i) create and identify your account, (ii) pre-fill the Stripe payment page and send your payment receipt, (iii) send a purchase confirmation with your report links, and (iv) send a one-time sign-in link (valid for 24 hours) when you ask via “Find my reports”. These are transactional and service emails; we don’t use your email for marketing unless you separately agree.
- Referral / promo codes: if you enter a code, we record it on the order to calculate the discount and our partners’ (creators’) commission. Partners only receive totals (number of orders, amounts), never your email or birth details.
- Birth details: the name or nickname, gender, date, time and place of birth you provide. These may be relatively sensitive personal data, and we use them only to calculate your chart and generate your reports.
- Love questions (optional): if you use “Your future love” in the Love Report, we ask who you are usually attracted to (men / women / both / prefer not to say) and your current relationship status (single / dating / married / it’s complicated / prefer not to say). These are relatively sensitive, completely optional, and “prefer not to say” is always available. They are only used to adjust the wording and content of that section, never for advertising or shared with third parties. You can delete them at any time with “Change / clear my answers” on the report page, and they are deleted with your account.
- Compatibility (your partner’s birth details): if you buy a compatibility report, you provide your partner’s name or nickname, gender, date, time and place of birth, and confirm that you have their consent. These details are only used to create your compatibility report, are stored under your account, and are never sold or used for marketing. They are deleted with your account, and your partner can also ask us to delete them.
- Payment details: payments are processed by Stripe. We never see or store your card number; we only keep the order number, amount, currency and status.
- Usage data: ad source information (such as utm parameters and ad variant) to understand which promotions work.
- Cookies: essential cookies needed to sign in and to remember your language and currency; if the site enables the Meta Pixel, it only loads with your consent.
2. Why we collect it (DPP 1 and 3)
- To calculate, generate and display your chart and reports
- To process payments, issue receipts and handle refunds
- To send purchase confirmations and “Find my reports” sign-in links
- To answer questions and provide support
- With your consent, to send product news (you can opt out at any time)
We never sell your personal data, and we don’t use it for direct marketing or pass it to third parties for direct marketing without your consent.
3. Transfers
To provide the service, data may be stored on or processed by the following providers (which may be outside Hong Kong): cloud hosting (e.g. Vercel), database (e.g. Neon / Supabase), payments (Stripe), email delivery (if enabled, e.g. Resend — only the recipient address and email content, to send confirmations and sign-in links), security services (if enabled, e.g. Cloudflare Turnstile for bot protection and Upstash for rate limiting — these process technical data such as IP addresses, not your birth details), and (if enabled) an AI wording-polish service (only the already-calculated report text, never your email). We require providers to take reasonable security measures.
Your account, chart, order and report data are stored on cloud servers outside Hong Kong: the database is hosted by Neon in Singapore (AWS ap-southeast-1), and the website runs on Vercel in Singapore (sin1); payment data is processed by Stripe on its global servers.
4. How long we keep it (DPP 2)
Account and chart data are kept until you delete your account. Payment and receipt records are kept as required for tax and accounting (generally at least 7 years), separately from birth details.
5. Security (DPP 4)
Passwords are hashed with bcrypt; the whole site uses HTTPS; only authorised staff can access the admin area, which is protected by two-factor authentication.
6. Access, correction and deletion (DPP 6)
You have the right to access and correct your personal data. You can tap “Request deletion of my data” in “My account”, or email monsterprojecthk@gmail.com. We reply to data access requests within 40 days and handle deletion requests as soon as possible.
7. Minors
This service is intended for people aged 18 or over.
8. Contact us
Privacy enquiries: monsterprojecthk@gmail.com · 【待填】香港營業地址