AI shopping assistance
If you choose to chat with our shopping assistant, your messages and relevant public product information may be processed by OpenAI or Google to generate replies. Please do not share payment credentials or sensitive identity documents. Conversation history is kept in your current browser tab and expires after 24 hours; you can clear it with “New chat”. Our server records model usage counts, not conversation text. Model providers process requests under their applicable data policies. Order details should be viewed through your own authenticated account or secure order link.
Contents
Checkout details
You can buy without registering or completing a member profile. We ask for your name, email, delivery address and a courier contact number to process the order, send transaction updates and deliver your purchase. Birthday, anniversary, social accounts and marketing sign-up are not required. Postal and regional fields depend on the delivery destination.
Checkout drafts are stored only in the current browser tab with a 30-minute inactivity expiry. You can clear the fields from checkout. Payment confirmation clears that draft. Legacy persistent checkout drafts are removed when you revisit the updated site. Once you continue to payment, an order record is created on our server and follows the order-record retention schedule below; clearing a browser draft does not delete an existing order.
Stripe processes the payment and receives your email to prefill checkout. We do not receive full card numbers or card security codes. OSMANTHIA remains responsible for its own use of order and customer information. Authorised operations staff and relevant service providers receive only the information needed for their assigned tasks. Stripe privacy information.
1. Who we are
OSMANTHIA is a laboratory-grown fine jewellery brand based in Hong Kong SAR. In this policy, "we", "us" and "our" refer to OSMANTHIA. We are the data controller responsible for personal information collected through www.osmanthia.com.
2. Information we collect
Profile details you choose to share (all optional): title, birthday, anniversary, WhatsApp number, WeChat ID, and preferred ring size. We use these only to personalise your experience — for example a birthday-month treat or getting your ring size right — and never sell them. You can edit or remove them any time in My Account.
Information you give us
- Account details — email address, password (stored only as an irreversible hash), name.
- Order details — shipping address, phone number, recipient name, and any engraving text you supply.
- Communications — messages you send to customer care.
Information collected automatically
- Device and usage data — IP address, browser type, pages viewed, referring site.
- Approximate location — derived from IP address, used only to preselect your currency.
Information we never receive
We do not collect or store full payment card numbers. Card details are entered directly into our payment processor's secure fields and never reach our servers.
3. How we use your information
| Purpose | Legal basis |
|---|---|
| Processing and delivering your order | Performance of a contract |
| Customer care and after-sales service | Performance of a contract |
| Fraud prevention and account security | Legitimate interests |
| Showing prices in your local currency | Legitimate interests |
| Marketing emails | Your consent — withdrawable at any time |
| Tax, customs and accounting records | Legal obligation |
4. Cookies and similar technologies
We use a small number of cookies and browser storage keys:
| Type | What it does |
|---|---|
| Essential | Keeps your shopping bag and login session. The site cannot function without these. |
| Preference | Remembers your chosen language and currency. |
| Analytics | Aggregated, non-identifying statistics on how the store is used. |
You can clear or block cookies in your browser settings. Blocking essential cookies will prevent checkout from working.
5. Who we share your information with
We do not sell your personal information. We share it only with service providers who need it to fulfil your order:
- Payment processors — to take payment securely and prevent fraud.
- Shipping carriers (such as DHL and FedEx) — name, address and phone number, so your parcel can be delivered.
- Customs authorities — order value and item description, where required by law for import clearance.
- Hosting and email providers — under contractual confidentiality obligations.
6. International transfers
Our order system is hosted in Singapore, with operations in Hong Kong SAR. Hosting and email providers, payment providers such as Stripe, and delivery providers may process relevant information outside your country of residence. Processing locations depend on the provider and service. If you choose to use the AI shopping assistant, the separate AI notice above explains processing by OpenAI or Google. Contact us for information about the processing and transfer arrangements applicable to your enquiry or order.
7. How long we keep your information
| Data | Retention period |
|---|---|
| Order and transaction records | 7 years (accounting and tax obligations) |
| Account information | Until you ask us to delete it |
| Marketing preferences | Until you unsubscribe, plus 12 months |
| Website analytics | 26 months |
8. Your rights
Depending on where you live, you may have the right to:
- Access a copy of the personal information we hold about you
- Correct information that is inaccurate or incomplete
- Delete your information, subject to records we must keep by law
- Object to or restrict certain processing
- Withdraw consent to marketing at any time
- Data portability — receive your data in a machine-readable format
To exercise any of these rights, contact our team at admin@osmanthia.com. We will respond within 30 days. You may also lodge a complaint with your local data protection authority — in Hong Kong, the Privacy Commissioner for Personal Data (PCPD).
9. How we protect your information
- All traffic to and from this site is encrypted with TLS (HTTPS).
- Passwords are stored using the Argon2id hashing algorithm and are never recoverable — not even by us.
- Access to customer data is limited to staff who need it to do their job.
10. Children
Our store is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.
11. Changes to this policy
If we make material changes, we will update the date at the top of this page and, where appropriate, notify registered customers by email.
12. Automated decisions and fraud screening
Orders are screened automatically for fraud risk by our payment processor before they are accepted. This screening looks at signals such as the card issuing country, the match between billing and delivery address, and the order value. A high-risk score can cause an order to be declined.
No decision that produces a legal or similarly significant effect on you is made by automated means alone. If your order is declined and you believe this is wrong, contact us and a person will review it.
13. US state privacy rights
If you are a resident of California, Colorado, Connecticut, Virginia or another US state with a comprehensive privacy law, you have the right to know what personal information we hold, to request a copy, to request correction or deletion, and to opt out of targeted advertising.
To exercise any of these rights, contact our team at admin@osmanthia.com with the request subject "Privacy Request". We will verify your identity using the email address on your order before we act. We will not discriminate against you for exercising these rights. You may use an authorised agent, in which case we will ask for proof of authorisation.
14. Data breaches
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and will notify you directly without undue delay where the risk to you is high.
15. Contact us
Hong Kong SAR
admin@osmanthia.com
We aim to respond to all privacy enquiries within 30 days.