Privacy Policy

LOW KEY CO LIMITED, a company registered in Hong Kong, is responsible for the personal information handled by MAFFIX.IO ("MAFFIX", "we", "us" or "our").

This Policy describes the information we collect, why we use it, who receives it and the choices available to you. Additional information may be provided when a particular service collects your information.

Our Terms & Conditions, Refund Policy and Shipping Policy explain the rules for using the Platform and obtaining products and Rewards.

INFORMATION YOU PROVIDE

• Account details, including your name, email address, date of birth and password. Passwords are stored as hashes rather than plain text.
• Profile details you choose to provide, such as an avatar, gender, clothing size and shoe size, and your account preferences.
• Delivery details, including the recipient's name, postal address and contact number, where needed for an order or physical Reward.
• Mission submissions, including action details, links, screenshots or other evidence you provide where the mission requires them.
• Support enquiries, including your name, contact details, order or redemption reference, message and any other information you choose to send us.

Forms identify the information needed for the relevant service. If you do not provide required information, we may be unable to create your account, process a purchase, deliver a product or answer your enquiry. Optional profile information is voluntary.

ACCOUNT AND SERVICE RECORDS

We record information generated when you use account features, including sign-in dates, mission progress and verification results, Diamonds and XP activity, membership and purchase records, Reward Pulls, allocations, redemptions, shipping status and policy acknowledgements.

Our website and infrastructure may also process technical information such as IP addresses, browser or device information, request times and security events to operate the service, investigate errors and prevent abuse.

PAYMENTS AND OTHER THIRD PARTIES

Payments are handled through Stripe. Payment details entered into Stripe's payment interface are processed by Stripe. MAFFIX receives information needed to manage the transaction, such as payment references, amounts, currency, payment status and relevant billing or delivery details. We do not store full payment-card numbers or card security codes in our application database.

We may receive delivery and tracking updates from fulfilment or delivery providers. If you leave MAFFIX to use an external website, that service handles information under its own privacy notice.

We use personal information to:

• Create and manage accounts, authenticate sign-ins and check age eligibility.
• Maintain profile preferences, membership benefits and account activity.
• Verify mission submissions and administer Diamonds, XP, Reward Pulls and physical Reward redemptions.
• Process purchases, payments, refunds and deliveries, and maintain transaction records.
• Send authentication codes and necessary account, payment, order and service messages.
• Answer enquiries and investigate product, delivery or account issues.
• Monitor service performance, resolve errors and protect the Platform against fraud, unauthorised access and duplicate or abusive activity.
• Meet applicable legal obligations and handle disputes.

Registering, signing in or acknowledging this Policy does not by itself subscribe you to marketing. If we use your personal information for direct marketing, we will obtain the permission required by applicable law and provide a way to opt out.

We disclose information where needed for the purposes described in this Policy, including to:

• Stripe, to process payments and related refunds or payment disputes.
• Hosting, database and storage providers, to operate and maintain the Platform.
• Email delivery providers, including Resend where configured, to send authentication, account, order and support messages.
• Fulfilment partners and delivery providers, to prepare, dispatch and deliver physical products and Rewards and investigate shipment issues.
• Professional advisers or public authorities, where needed to meet legal obligations, respond to lawful requests or handle disputes.

Information shared with a service provider should be limited to what is needed for its role. A provider's own privacy notice may also apply where it processes information for its own purposes, for example payment processing or legal compliance.

We may also share information at your request or with your permission. We do not sell your personal information.

We use security measures such as password hashing, authenticated access, permissions and measures to limit abusive requests. Access to customer information is restricted according to the function being performed.

No internet service or storage system can be guaranteed completely secure. Keep your sign-in details confidential and contact us if you suspect unauthorised use of your account.

Do not send your password, authentication codes or full payment-card details through the support form or email.

ACCESS AND CORRECTION

You can review and update available profile and account settings while signed in. You may also contact us to request access to, or correction of, personal information we hold about you.

DELETION AND OTHER REQUESTS

You can use the account settings to request permanent account deletion or contact us about deleting personal information. Temporary deactivation preserves the account so that it can be reactivated; it is different from permanent deletion.

Depending on the law that applies to you, you may also have rights to receive a copy of your information, request a portable copy, restrict or object to certain processing, or withdraw consent where processing depends on consent. Withdrawing consent does not affect processing already carried out lawfully.

We may need reasonable information to confirm your identity and understand the request. Some requests are subject to lawful exceptions, including where information must be retained for an order, legal obligation or dispute. We will explain applicable limitations when responding.

To make a request, use our Get In Touch page or the contact details below. You may also contact the relevant privacy regulator, including the Office of the Privacy Commissioner for Personal Data, Hong Kong, about a privacy concern.

COMMUNICATIONS

Available notification preferences can be managed through your account settings. You can contact us to opt out of direct marketing or use an unsubscribe option where provided. Necessary authentication, security and transaction messages may still be sent.

COOKIES AND BROWSER STORAGE

We use cookies for functions such as authentication and session security. Browser storage is also used for functions such as retaining a pending support submission, a checkout reference or an in-progress account activity so it can be resumed.

You can control cookies and clear website storage through your browser. Doing so may sign you out or remove pending information stored on that device. Essential account or checkout functions may not work when the required cookies or storage are blocked.

If optional analytics or advertising technologies are introduced, we will provide information about them and obtain any consent required before using them.

We keep personal information for the purposes described in this Policy, taking account of the type of information, whether your account is active, outstanding orders or enquiries, and applicable accounting, legal and dispute-handling requirements. Information should not be retained longer than needed for those purposes.

Permanent account deletion removes or anonymises core account information and clears saved addresses, linked sign-in accounts and certain account activity. It does not automatically erase every record associated with the account. Order, payment, Reward, delivery, support or other records may remain where needed to complete transactions, handle disputes or meet applicable obligations. A retained transaction record may contain the delivery information supplied when the transaction was made.

Contact us if you want to understand what information remains after deletion or request further erasure. We will assess the request against the relevant purpose and legal requirements. Copies in backups may remain until the applicable backup retention cycle ends.

MAFLETE account registration requires users to be at least 13. We do not knowingly collect personal information from children under 13 through account registration. If you believe a child under 13 has supplied personal information, please contact us so that we can investigate and take appropriate action.

Additional age and parental-permission conditions for purchases and other activities are described in our Terms & Conditions. Being eligible to register does not remove those conditions.

MAFFIX is based in Hong Kong. Hosting, payment, email and delivery services may process personal information in other countries, including countries where you request delivery. Their privacy laws may differ from those in your country.

Where applicable law requires safeguards for a transfer, we will use the required safeguards before transferring the information. You can contact us for information about the overseas recipients and safeguards relevant to your personal information.

We may update this Policy when our services or personal-information practices change. The date above identifies this version, and a permanent link is provided below.

Where a change requires notice or additional consent under applicable law, we will provide that notice or request that consent. Continuing to use the Platform does not by itself give consent to a new use of personal information that requires separate consent.

For privacy questions or requests to access, correct or delete personal information, please contact MAFFIX Support through our Get In Touch page or email support@maffix.io. Please identify your message as a privacy enquiry.

Postal correspondence can be addressed to:

MAFFIX Support — Privacy Enquiries
LOW KEY CO LIMITED
Flat F, 10/F., Valiant Industrial Centre,
2-12 Au Pui Wan Street, Fotan,
Shatin, Hong Kong