Privacy Policy

1. What personal information we collect

The Platform has no public sign-up. Accounts are opened by Stardust or an administrator of your organization. We collect only what is needed to provide the service:

• Account information: work email and name. Your phone number is optional and collected only if you provide it.
• Sign-in and security information: your password (stored only as an irreversible hash), email verification code records, the IP address you sign in from, the country or region derived from it, device and browser type, and sign-in and sign-out times.
• Business information: your organization's name, your membership and level, the orders, quotes, product information, delivery addresses and contact phone numbers, payment proofs, shipping documents and other files you create on the Platform, and related activity records.
• Interface preferences: language and time zone.

2. How we use this information

• To open and manage accounts, verify your identity and prevent account misuse (for example new-device and new-region sign-in alerts, and email verification for sensitive actions).
• To show and process orders, quotes, files and messages according to your organization's permissions, and to show a trading counterparty what is necessary to complete a transaction.
• To send system emails: invitations, verification codes, security alerts, order status and review results.
• To keep activity records for security auditing, troubleshooting and legal compliance.
• To improve the stability and security of the Platform. We do not use your personal information for advertising and do not sell it to anyone.

3. Cookies and local storage

We use only the cookies needed to run the service. We use no advertising or cross-site tracking cookies:

• Session cookie: keeps you signed in. It ends when you sign out or after a long period of inactivity.
• Device cookie: recognizes a device you have already verified. It lasts up to about 400 days, and you can revoke devices on the Account page.
• Language cookie: remembers the interface language you chose.

4. Storage and cross-border transfer

The Platform's servers are located in the Hong Kong Special Administrative Region of China. For users in mainland China this means your personal information is transferred to and stored outside the mainland, which is a cross-border transfer of personal information. We ask for your consent separately, with its own tick box, the first time you sign in. You can read the notice and withdraw your consent at any time on the Account page. After you withdraw, you cannot keep using the Platform until you confirm again.

To provide the service, the following recipients may process your personal information:

• Server and storage provider (in Hong Kong): hosts the Platform's application, database and file storage, and handles all the information listed in section 1. When the provider for the production environment is settled, we will update its name and contact details on this page.
• System email provider Resend, Inc. (United States): processes the recipient's email address, name and the email content solely to send system emails. Security alert emails may include the sign-in time, region, IP address and device type. Contact details are on its website, resend.com.
• Error and availability monitoring services (once enabled): may receive technical diagnostic data that does not identify individuals. We try to keep personal information out of it.

5. How we protect your personal information

• Encryption in transit: the whole site uses HTTPS.
• Secure storage: the database and backups are stored encrypted. Sensitive fields such as phone numbers and bank accounts are separately encrypted in the application. Passwords are stored only as irreversible hashes.
• Access control: visibility is limited by organization and level. Sensitive actions need an email code, and two-step verification can be required for platform accounts.
• Auditing: key actions are written to an append-only audit log kept for at least one year.
• Platform staff can view a customer organization's data only after that organization's owner grants access. The access is read-only, ends automatically after 7 days, and is fully logged.

6. How long we keep it

Account information is kept while the account is active. After an account is disabled or you ask for deletion, we delete or anonymize your personal information once the retention periods required by law have passed. Business records such as orders, reconciliation and invoices, and audit logs, are kept for as long as laws and the legitimate interests of trading counterparties require.

7. Your rights

You have the right to access, copy, correct, supplement and delete your personal information, to withdraw consent, and to ask us to explain our processing rules. You can:

• On the Account page, view and change your name, phone number, language and time zone, change your password, manage signed-in devices, and view or withdraw your cross-border transfer consent.
• Email us at the address below to request access, a copy or deletion. We reply within a reasonable time, generally within 15 working days.

8. Minors

The Platform is for business users and is not intended for anyone under 18. We do not knowingly collect personal information from minors.

9. Changes to this policy

We may update this policy from time to time. For important changes such as cross-border transfer, we ask for your consent again the next time you sign in. Other changes are published on this page with the update date.

10. Contact us

If you have questions, comments or requests about this policy or your personal information, contact Stardust (Shenzhen) Consulting Co., Ltd. at zhijie@stardust-company.com.