This site (“we”, “us”) is run by an individual seller and provides a third-party ChatGPT Plus / Pro top-up service. We take your personal data seriously and handle it in accordance with Hong Kong’s Personal Data (Privacy) Ordinance (Cap. 486) and its Data Protection Principles. This policy explains what we collect, why, how we store and protect it, and your rights.
💡 Please read this policy carefully before using our service. By signing up or placing an order, you confirm that you understand and agree to it.
1. Data we collect
We only collect what we need to provide the service:
- Site account data: your sign-up email and site password (stored as a PBKDF2 hash — we can never see the plain text)
- Order data: the phone number, contact handle (WeChat / WhatsApp / Telegram), the ChatGPT account email to be upgraded and any note you enter when ordering, plus order records (plan, amount, status, payment method)
- Technical data: IP address, browser user agent and access time, used for security and abuse prevention
- Traffic source: how you reached us (e.g. search engine, referring domain, utm parameters on campaign links), landing page, device type and country / region, used to measure how well each channel works. We do not use tracking cookies; on-site statistics are de-duplicated with an anonymous ID generated by an irreversible hash that rotates daily and cannot be traced back to your IP or user agent. srcstat stores a random anonymous visitor ID (
_sv_vid) in your browser’s localStorage. It contains no personal data, and you can delete it at any time by clearing this site’s data in your browser
- Email verification codes: the 6-digit codes sent when you sign up or reset your password (stored as a hash, valid for 5 minutes)
We never collect your ChatGPT password, and we don’t collect ID card numbers, bank or credit card details, or the content of your conversations with ChatGPT.
2. Why we collect it and how we use it
- Processing orders, topping up the ChatGPT account you specify, renewal reminders and after-sales support
- Verifying payments and contacting you to confirm orders
- Site account sign-up verification, password recovery and keeping you logged in (30-day session cookie)
- Preventing abuse and keeping the service secure (rate limiting, blocking suspicious accounts)
- Improving the service using aggregated data that doesn’t identify you
We will not sell your personal data or use it for direct marketing or anything unrelated to this service.
3. Data transfers and third-party services
To run the service we rely on the following third parties, so some data may be processed outside Hong Kong:
- Cloudflare Workers / D1: hosting for the website and database (stored on Cloudflare’s global edge network)
- Cloudflare Email Sending / Resend: sending sign-up codes, password resets and order notification emails
- srcstat (stats.imwsl.com): anonymous traffic statistics. It only receives the anonymous visitor ID, the traffic source and order conversions (order number, amount), and does not receive your email, phone number, contact handle or ChatGPT account
We only use the ChatGPT account email you provide to the extent needed to complete the top-up, and never disclose it to unrelated third parties.
4. How long we keep data
- Site account data is kept until you ask us to close your account
- Order data is kept for 2 years for after-sales support and renewals, then deleted
- Email verification codes expire after 5 minutes and are marked as used once verified
- Session cookies expire after 30 days; rate-limit counters are kept only briefly (minutes to hours)
5. Your rights
Under the Personal Data (Privacy) Ordinance, you have the right to:
- Access your data: log in to My account to see your email, sign-up date and order history, or send us a data access request
- Correct your data: if anything is inaccurate, contact support to have it corrected; you can change your password yourself in account settings
- Delete your data / close your account: contact us via “Support” at the bottom right and we’ll handle it within 3 working days
- Opt out of statistics: use a browser blocking extension to stop srcstat, or clear this site’s data to delete the anonymous visitor ID
We will respond to data access or correction requests within 40 days of receiving them.
6. Security
- Passwords are hashed with PBKDF2-SHA256 and a unique salt, so they can’t be recovered even if data leaks
- Login sessions use HttpOnly + Secure cookies that scripts cannot read
- Every submitted request has its origin checked to reduce CSRF risk
- Rate limiting guards against brute-force attempts and fake orders
- If a data breach occurs, we will notify affected users by email as soon as possible and report to the Office of the Privacy Commissioner for Personal Data where appropriate
7. Minors
This service is not intended for anyone under 18. ChatGPT itself also has age requirements — please follow OpenAI’s rules. Minors who wish to use the service must have consent from a parent or guardian.
8. Changes to this policy
We may update this policy when laws or our service change. Major changes will be highlighted at the top of the page; minor ones will update the “Last updated” date. By continuing to use the service, you accept the updated policy.
9. Contact us
If you have any questions or complaints about this policy, or want to exercise the rights above, contact us via Support at the bottom right. We usually reply within minutes during business hours, and always within 3 working days.
This English version is provided for convenience. If there is any inconsistency, the Traditional Chinese version prevails.