Privacy Policy
Effective date: November 3, 2026
1. Who we are and scope
This policy explains how 懒人科技有限公司 ("we", "us") processes personal information when operating OXONI at oxoni.uk and Lanren Shop at shop.oxoni.uk. It covers browsing, guest purchases, available account features, payment processing, delivery and support. Contact us at [email protected] for privacy or order-related requests. It does not replace the independent policies of payment providers or other sites you choose to use.
2. Information we collect
We collect the information needed for the feature you use: your email address and an order lookup credential for guest orders; account and sign-in information if account features are enabled; selected products, quantities, prices, currency, order identifiers, payment status and transaction references; delivery records and information expressly required by a listing; and correspondence and evidence you provide for support. Our infrastructure also processes IP addresses, request times, requested pages, browser/device information and security events. We do not ask for unrelated identity documents, third-party credentials or complete payment-card details in shop forms.
3. How and why we use information
We use this information to create and authenticate orders, process and reconcile payments, provide the purchased digital goods or services, answer support and refund requests, protect the service against unauthorised access and fraud, maintain necessary business records, and meet applicable legal obligations. An email address, query credential and information genuinely required for fulfilment are necessary to complete a guest order; withholding them may prevent that order or secure lookup. Browsing does not require creating a customer account. We do not treat placing an order as consent to unrelated marketing.
4. Guest credentials and browser storage
The server stores a keyed, non-reversible verification value for a guest order password rather than its original text. To let you continue an order in the same browser tab, the storefront keeps the guest email and lookup credential in session storage. Other local storage supports the cart, language preferences and available sign-in features. These stores are on your device; browser session-restoration features can affect how long they remain. Keep your lookup password private and clear browsing/session data on shared devices. Clearing storage may require re-entering credentials or rebuilding the cart; it does not itself delete server-side order records.
5. Payments and service providers
When Stripe Checkout is available and you choose it, payment-card details are entered in Stripe’s hosted interface. Our shop does not receive or store your complete card number or card security code. We send Stripe necessary checkout information such as the order reference, amount, currency and email address, and receive transaction identifiers and payment/refund status. Stripe also processes information for payment security and its own legal obligations, as explained in its Stripe Privacy Policy. Oracle supplies our hosting infrastructure, and Cloudflare supplies DNS, proxy/security services and domain email routing. Domain support email is routed through Cloudflare to a private Microsoft Outlook inbox; those email services process the message and its delivery information. These providers process information required to operate their services. See the Cloudflare Privacy Policy for its handling of data.
6. Sharing and international processing
We disclose information only as needed to payment, hosting, network, email and fulfilment providers; personnel or advisers who need it for support or required business administration; or authorities and other parties where a valid legal requirement or the protection of legal rights justifies it. A fulfilment provider receives only information needed for the stated delivery. We do not sell customer personal information. The main shop server is hosted in the United Kingdom. Service-provider systems and protected backups may process information in other countries. Where required, we apply appropriate transfer safeguards or obtain the necessary consent. A .uk domain or UK server location does not by itself describe the operator’s place of incorporation.
7. Retention and security
We retain order, payment, delivery and support records only for the periods needed for fulfilment, after-sales service, disputes, accounting and applicable legal requirements, then delete or anonymise them where appropriate. Routine origin Nginx access logs are configured for up to 30 days, and routine daily backups on the production server rotate over 14 days. Separate security evidence or records under a valid preservation obligation may need longer retention. Backups are access-controlled and removed through their retention cycle; a valid deletion is also to be respected when restoring production data. We use HTTPS, restricted administrative access, credential verification values and protected backups. No network or storage system is risk-free; we handle security incidents and any required notifications under applicable requirements.
8. Your choices and requests
Email [email protected] to request access to or correction of your information, or deletion, restriction, objection or withdrawal of consent where the applicable law provides those rights. Include only enough information to identify the relevant order or request. We may verify your relationship to an order without requesting unnecessary sensitive material. Certain records may have to be retained for legal obligations or an unresolved dispute; we will explain any applicable restriction. Withdrawal of consent does not invalidate prior lawful processing. You may also complain to the appropriate data-protection authority, including Hong Kong’s Privacy Commissioner where the Personal Data (Privacy) Ordinance applies.
9. Children, links and marketing technologies
Users must have the capacity or appropriate guardian authorisation needed for the transaction. We do not deliberately request children’s personal information for marketing; a guardian who believes information was supplied inappropriately may contact us. External websites and third-party products have their own privacy practices. The current storefront does not deploy advertising retargeting or behavioural advertising analytics. Stripe and Cloudflare may use storage and security technologies within their services. Before introducing non-essential tracking, we will update the relevant information and provide choices or obtain consent where required.
10. Changes and contact
The effective date below identifies this version. We will publish material changes with an updated date and provide additional notice or obtain consent when required for a new use of information. Privacy, customer-service and refund correspondence can all be sent to [email protected]. Please do not send complete card details, card security codes, API keys or unrelated identification documents.